PT-2026-34062 · Wwbn · Avideo

Published 2026-04-14 · Updated 2026-04-27 · CVE-2026-40908

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier

Description The file 'git.json.php' located at the web root executes the git log -1 command and returns the full output as JSON to unauthenticated users. This leads to the exposure of the deployed commit hash, developer names, email addresses, and commit messages, which may contain references to internal systems or security fixes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-40908

GHSA-52HF-63Q4-R926

Affected Products

Avideo

References · 6

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926 · Exploit
• https://osv.dev/vulnerability/GHSA-52hf-63q4-r926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40908 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/CVEnew/status/2048910155690238363 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046689653630144623 · Twitter Post