What is the CVSS score of CVE-2026-35180?

CVE-2026-35180 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-35180

EUVD-2026-19454 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-06 GitHub_M

CSRF PHP

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 06, 2026 - 19:30 euvd

EUVD-2026-19454

Analysis Generated

Apr 06, 2026 - 19:30 vuln.today

CVE Published

Apr 06, 2026 - 19:06 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the site customization endpoint at admin/customize_settings_nativeUpdate.json.php lacks CSRF token validation and writes uploaded logo files to disk before the ORM's domain-based security check executes. Combined with SameSite=None cookie policy, a cross-origin POST can overwrite the platform's logo with attacker-controlled content.

AnalysisAI

Cross-site request forgery in WWBN AVideo 26.0 and earlier allows unauthenticated remote attackers to overwrite the platform's logo file via a malicious cross-origin POST to the admin/customize_settings_nativeUpdate.json.php endpoint. The vulnerability exploits missing CSRF token validation combined with a SameSite=None cookie policy and a file-write-before-validation logic flaw, enabling integrity compromise of the site's branding. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

WWBN AVideo is a PHP-based open-source video hosting platform. The vulnerability stems from CWE-352 (Cross-Site Request Forgery) in the site customization endpoint. The root cause is a logic sequence flaw: the admin/customize_settings_nativeUpdate.json.php endpoint writes uploaded logo files to disk before the ORM's domain-based security check executes, leaving a race condition window. The endpoint also lacks CSRF token validation entirely, allowing any cross-origin POST request to trigger the file operation. The SameSite=None cookie attribute on the platform's session cookies permits the browser to send credentials in cross-origin requests, eliminating the modern CSRF protection that SameSite=Strict or SameSite=Lax would provide. This combination of missing token validation, premature file persistence, and permissive cookie policy creates a direct CSRF vector.

RemediationAI

Upgrade WWBN AVideo to a patched version later than 26.0. The patch must include CSRF token validation on the admin/customize_settings_nativeUpdate.json.php endpoint (validating a cryptographically-signed token in POST requests before file operations), execution of the ORM's domain-based security check before writing files to disk, and review of SameSite cookie attributes to use SameSite=Lax or SameSite=Strict for session cookies instead of SameSite=None. Until patched, administrators can mitigate by restricting access to the admin panel via IP whitelisting or WAF rules, disabling file upload functionality for logos if not critical, and ensuring SameSite cookies are enforced at the application or web server level. See the GitHub Security Advisory GHSA-5572-2jgx-fc7c for detailed remediation guidance and patch availability.