What is the CVSS score of CVE-2026-35452?

CVE-2026-35452 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-35452

MEDIUM

Information Exposure (CWE-200)

2026-04-04 https://github.com/WWBN/AVideo

GHSA-99j6-hj87-6fcf

PHP Information Disclosure

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 04, 2026 - 06:30 vuln.today

CVE Published

Apr 04, 2026 - 06:17 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Summary

The plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

Details

The entire file at plugin/CloneSite/client.log.php:

php

<?php
include '../../videos/cache/clones/client.log';

No authentication check. The log file is populated by cloneClient.json.php which writes operational details during clone operations:

php

// plugin/CloneSite/cloneClient.json.php:118
$log->add("Clone (2 of {$totalSteps}): Geting MySQL Dump file [$cmd]");

The $cmd variable contains wget commands with internal filesystem paths, and rsync command templates with SSH connection details (username, IP, port).

Compare with sibling endpoints:

plugin/CloneSite/index.php checks User::isAdmin()
plugin/CloneSite/changeStatus.json.php checks User::isAdmin()
plugin/CloneSite/clones.json.php checks User::isAdmin()
plugin/CloneSite/delete.json.php checks User::isAdmin()

Proof of Concept

bash

curl "https://your-avideo-instance.com/plugin/CloneSite/client.log.php"

If the CloneSite feature has been used, the response contains wget commands, filesystem paths, SSH metadata, and SQL dump file locations.

Impact

Unauthenticated disclosure of internal infrastructure details that could aid targeted attacks against the clone source server.

Recommended Fix

Add an admin authentication check at plugin/CloneSite/client.log.php, before the include:

php

require_once '../../videos/configuration.php';
if (!User::isAdmin()) {
    http_response_code(403);
    die('Access denied');
}

--- *Found by aisafe.io*

AnalysisAI

Unauthenticated information disclosure in AVideo CloneSite plugin allows remote attackers to retrieve sensitive operational logs containing internal filesystem paths, remote server URLs, and SSH connection metadata via the client.log.php endpoint, which lacks authentication controls present in all sibling endpoints within the same plugin directory.

Technical ContextAI

The AVideo platform's CloneSite plugin (pkg:composer/wwbn_avideo) includes an endpoint at plugin/CloneSite/client.log.php that directly includes a log file without verifying admin privileges. The underlying issue is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a failure to implement consistent access controls. While all other CloneSite endpoints enforce User::isAdmin() authentication, this single endpoint bypasses that check entirely. The log file is populated during clone operations by cloneClient.json.php, which records command-line operations including wget commands with embedded filesystem paths and rsync templates containing SSH credentials (username, host, port). The vulnerability exists because the application implements a defensive pattern (admin checks) inconsistently across functionally related endpoints, and the log file itself contains operational details that should be restricted to authenticated administrators.

RemediationAI

Implement admin authentication checks in the client.log.php endpoint by adding a require statement for configuration.php followed by a User::isAdmin() guard before including the log file, returning HTTP 403 if the check fails-this matches the security pattern already implemented in index.php, changeStatus.json.php, clones.json.php, and delete.json.php within the same plugin directory. Patch availability from the vendor is indicated by the GitHub Security Advisory (GHSA-99j6-hj87-6fcf); consult the official AVideo repository and security advisories at https://github.com/WWBN/AVideo/security/advisories/GHSA-99j6-hj87-6fcf for the specific patched version and upgrade instructions. Additionally, review server logs to determine if the endpoint has been accessed by unauthorized parties and monitor for any indicators of compromise targeting SSH credentials or internal infrastructure details disclosed in the log.