Executive brief
WWBN AVideo is a self-hosted video platform. The application contains a cross-site request forgery vulnerability in its log archival feature that allows attackers to trick administrators into inadvertently downloading application logs and erasing them from the server. An attacker could expose sensitive operational data and destroy evidence of prior intrusions or misuse.
Technical details
The vulnerability is a cross-site request forgery (CWE-352) in view/logArchive.json.php that lacks CSRF token validation and accepts GET requests. The endpoint archives the application log file (containing sensitive diagnostic and access information) into a publicly accessible zip file under the videos/ directory, then truncates the live log. The only access control is a permissions check (Permissions::canSeeLogs()), which is insufficient because the CSRF guard runs only on POST requests to *.json.php endpoints. An unauthenticated attacker can craft a malicious web page that triggers an administrator's browser to issue a GET request to the endpoint, causing logs to be copied and the live log to be wiped. The advisory states the vulnerability remains unfixed as of the publication date (2026-08-23).
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-26: disclosed: GitHub Security Advisory GHSA-66vx-xf88-hpw8 published
- 2026-09-10: advisory: CVE-2026-88873 assigned and published on NVD