Executive brief
WWBN AVideo is an open-source platform used for hosting and sharing video content. A security flaw in the platform's site-cloning plugin allows anyone on the internet to view sensitive system logs without logging in. These logs contain internal server details, such as file paths and connection information for remote servers, which could be used by an attacker to plan more advanced attacks against the organization's infrastructure.
Technical details
An information disclosure vulnerability (CWE-200) exists in WWBN AVideo versions 26.0 and prior due to missing authentication checks in the 'plugin/CloneSite/client.log.php' endpoint. While other endpoints in the CloneSite directory enforce 'User::isAdmin()', this specific script directly includes the 'client.log' file from the cache directory without verification. An unauthenticated remote attacker can access this endpoint to retrieve logs containing sensitive operational data, including 'wget' commands, internal filesystem paths, and 'rsync' templates that reveal SSH usernames, IP addresses, and ports. This metadata facilitates reconnaissance for further attacks against the video platform's infrastructure.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published by maintainers
- 2026-04-06: disclosed: CVE-2026-35452 published to NVD