CVE-2026-35180 — WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write

CVE-2026-35180

WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write PUBLISHED

Description (CNA)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the site customization endpoint at admin/customize_settings_nativeUpdate.json.php lacks CSRF token validation and writes uploaded logo files to disk before the ORM's domain-based security check executes. Combined with SameSite=None cookie policy, a cross-origin POST can overwrite the platform's logo with attacker-controlled content.

Affected (CNA)

Vendor / product	Versions
WWBN / AVideo	affected <= 26.0

CWE

CWE-352

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-5572-2jgx-fc7c

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.