CVE-2026-40908: 
PHP vulnerability analysis and mitigation

CVE-2026-40908 is an unauthenticated information disclosure vulnerability in WWBN AVideo, an open source video platform. The file git.json.php at the web root executes git log -1 and returns the full output as JSON to any unauthenticated user, exposing the deployed commit hash, developer names and email addresses (PII), and commit messages. All versions up to and including 29.0 are affected. The vulnerability was published on April 21, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The file git.json.php is a standalone PHP script with no authentication, no session validation, and no framework bootstrap — it directly executes a shell command (git log -1) and returns the result as JSON. The endpoint is not protected by .htaccess rules and is directly accessible to any network client over HTTP/HTTPS without any credentials or special headers. The exposed commit hash enables version fingerprinting against AVideo's 22 published GitHub Security Advisories (GHSAs), allowing attackers to identify which known vulnerabilities remain unpatched on a target instance (GitHub Advisory).

An unauthenticated remote attacker can determine the exact deployed version of AVideo and cross-reference it against known CVEs to identify unpatched vulnerabilities on the target instance. Developer names and email addresses exposed via git commit metadata can be leveraged for targeted phishing or social engineering attacks against project maintainers and contributors. Commit messages may additionally disclose references to internal bug trackers, security fix status, or infrastructure details, providing attackers with intelligence useful for further exploitation (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a single unauthenticated curl command requiring no cookies or special headers. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.031% (0.000310), indicating low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing AVideo instances using search engines (e.g., Shodan, Censys) or by browsing to known AVideo deployments. Confirm the presence of the git.json.php file at the web root.
2. Send unauthenticated request: Issue a simple HTTP GET request to the target endpoint — no authentication, cookies, or special headers required:

   curl -s https://target.example/git.json.php | python3 -m json.tool

3. Parse the JSON response: The response will contain the full git log -1 output, including the commit hash, author name, author email, commit date, and commit message.
4. Version fingerprinting: Cross-reference the exposed commit hash against AVideo's public git history and the 22 published GHSAs to determine which known vulnerabilities are unpatched on the target instance.
5. Harvest developer PII: Extract developer names and email addresses from the response for potential use in phishing or social engineering campaigns.
6. Analyze commit messages: Review commit messages for references to internal systems, security fixes in progress, or infrastructure details that may aid further attack planning (GitHub Advisory).

• Network: HTTP GET requests to /git.json.php from external or unexpected IP addresses; automated scanning patterns targeting this endpoint across multiple AVideo instances.
• Logs: Web server access logs (Apache/Nginx) showing requests to GET /git.json.php with HTTP 200 responses, particularly from unfamiliar or scanning IP ranges; high frequency of requests to this endpoint in a short time window.
• File System: Presence of git.json.php in the AVideo web root directory (its existence is itself the vulnerability indicator; verify whether it should be present in your deployment).

As of the time of publication, no patched version of AVideo is available for this specific vulnerability. The recommended fix is to delete git.json.php entirely from the web root, as it serves no user-facing purpose and exists only as a development/debug artifact (rm git.json.php). As an interim workaround, restrict network access to git.json.php via web server configuration (e.g., .htaccess deny rules or Nginx location blocks), or gate the endpoint behind authentication if version display is needed for administrators. Monitor the GitHub Security Advisory for patch availability (GitHub Advisory).

The vulnerability was reported by DanielnetoDotCom (the AVideo project maintainer) via GitHub's security advisory process on April 13, 2026, and published April 21, 2026. Coverage has appeared on several CVE aggregation and threat intelligence platforms including CVEFeed, VulDB, and Infinit Security. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).