CVE-2026-35452: 
PHP vulnerability analysis and mitigation

CVE-2026-35452 is an unauthenticated information disclosure vulnerability in the WWBN AVideo CloneSite plugin, where the plugin/CloneSite/client.log.php endpoint serves clone operation log files without any authentication check. All other endpoints in the CloneSite plugin directory enforce User::isAdmin(), making this a clear access control oversight. The vulnerability affects AVideo versions up to and including 26.0 and was published on April 2, 2026, with NVD publication on April 6, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, AVideo Advisory).

The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) — specifically, a missing authentication gate on a single PHP endpoint within the CloneSite plugin. The client.log.php file directly outputs the clone operation log, which includes $cmd variables populated with wget commands containing internal filesystem paths, rsync command templates with SSH usernames, IP addresses, and port numbers, and SQL dump file locations. An attacker needs only network access to the AVideo instance and that the CloneSite feature has been previously used; no credentials, special headers, or complex payloads are required. The recommended fix is to prepend an admin authentication check (User::isAdmin()) to client.log.php consistent with all sibling endpoints (GitHub Advisory, AVideo Advisory).

Successful exploitation allows any unauthenticated remote attacker to retrieve sensitive internal infrastructure details from the clone operation log, including server-side filesystem paths, remote server URLs, SSH connection metadata (usernames, IP addresses, ports), and SQL dump file locations. There is no integrity or availability impact, but the exposed data significantly lowers the barrier for targeted follow-on attacks against the clone source server or connected infrastructure. The information could be leveraged for reconnaissance, credential reuse, or lateral movement against systems referenced in the log (AVideo Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a single curl command: curl "https://your-avideo-instance.com/plugin/CloneSite/client.log.php". No authentication, special tooling, or payload crafting is required, making exploitation trivial for any attacker with network access. There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.034% (0.000340), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, AVideo Advisory).

1. Reconnaissance: Identify internet-facing AVideo instances (version ≤ 26.0) using search engines like Shodan or Censys, or by browsing to the AVideo login page to confirm the software and version.
2. Verify CloneSite plugin presence: Attempt to access https://target-avideo-instance.com/plugin/CloneSite/client.log.php directly — a 200 response with log content confirms the plugin is installed and the endpoint is vulnerable.
3. Retrieve the log file: Execute curl "https://target-avideo-instance.com/plugin/CloneSite/client.log.php" to retrieve the unauthenticated log output.
4. Extract sensitive data: Parse the response for wget commands (revealing internal filesystem paths and SQL dump locations), rsync command templates (revealing SSH usernames, IP addresses, and ports), and remote server URLs.
5. Leverage for follow-on attacks: Use the extracted SSH credentials/metadata to attempt access to the clone source server, or use filesystem paths and server URLs to inform further targeted attacks against the infrastructure (AVideo Advisory).

• Network: Unauthenticated HTTP GET requests to /plugin/CloneSite/client.log.php from external or unexpected IP addresses; absence of session cookies or authentication headers in requests to this endpoint.
• Logs: Web server access logs showing GET /plugin/CloneSite/client.log.php with HTTP 200 responses from non-administrative source IPs; repeated or automated requests to this path suggesting scanning activity.
• File System: Presence of a populated client.log.php log file in the CloneSite plugin directory containing SSH metadata and filesystem paths, indicating the CloneSite feature has been used and sensitive data is at risk of exposure.

The recommended fix is to add an admin authentication check at the top of plugin/CloneSite/client.log.php before any output, as follows:

require_once '../../videos/configuration.php';
if (!User::isAdmin()) {
    http_response_code(403);
    die('Access denied');
}

As of the advisory publication, no patched version has been released (the advisory lists "None" for patched versions), so operators should apply this code-level fix manually or restrict access to the endpoint via network-level controls (e.g., firewall rules, web server configuration blocking external access to /plugin/CloneSite/client.log.php). Additionally, any SSH credentials, server URLs, or filesystem paths exposed through the log should be rotated or reviewed for compromise (GitHub Advisory, AVideo Advisory).

The vulnerability was discovered and reported by aisafe.io and credited to researchers adrgs (reporter) and aisafe-bot (finder), with the advisory published by DanielnetoDotCom to the WWBN/AVideo repository. Coverage has been picked up by several vulnerability tracking platforms including VulDB, CVEFeed, and Infinit Security, but no significant broader media coverage or notable researcher commentary beyond the original advisory has been identified (GitHub Advisory).