What is the CVSS score of CVE-2026-40908?

CVE-2026-40908 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WWBN AVideo CVE-2026-40908

EUVD-2026-24286 MEDIUM

Information Exposure (CWE-200)

2026-04-21 GitHub_M

PHP Information Disclosure Avideo Wwbn

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible endpoint with no authentication required (AV:N, AC:L, PR:N, UI:N); only partial confidentiality impact from git metadata exposure - no credentials, no code execution, no integrity or availability impact (C:L/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:06 vuln.today

Analysis Generated

Jul 24, 2026 - 07:06 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 20:00 euvd

EUVD-2026-24286

CVE Published

Apr 21, 2026 - 19:52 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file git.json.php at the web root executes git log -1 and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting against known CVEs), developer names and email addresses (PII), and commit messages which may contain references to internal systems or security fixes. As of time of publication, no known patched versions are available.

AnalysisAI

Unauthenticated information disclosure in WWBN AVideo versions 29.0 and prior exposes the full output of git log -1 via a publicly accessible git.json.php endpoint, leaking the exact deployed commit hash, developer names and email addresses, and commit messages to any network client without credentials. The commit hash enables an attacker to fingerprint the precise deployed version and cross-reference it against AVideo's 22 published GHSAs to enumerate which vulnerabilities remain unpatched on a given instance - making this a high-value reconnaissance primitive even at a moderate CVSS score. A public proof-of-concept exists; no patched version has been released as of time of publication.

Technical ContextAI

The vulnerable component is a standalone PHP script (git.json.php) residing at the web root of WWBN AVideo (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*, versions up to and including 29.0). The script directly calls exec('git log -1') and serializes the shell output as JSON with no authentication check, no session validation, and no framework bootstrap - the file does not require any configuration or authentication module. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the endpoint is not gated by .htaccess rules, no HTTP authentication is enforced at the web-server level, and no conditional logic guards the response. The architectural flaw is that a developer utility script was left in the production web root with unrestricted public access.

RemediationAI

No vendor-released patch has been identified at time of analysis - the GHSA advisory and CVE description both state no patched version is available. The primary mitigation is to delete git.json.php from the AVideo web root entirely; this removes the exposure with no production-functionality trade-off since the file is a developer utility with no documented end-user purpose. If immediate deletion is not possible, operators should block access via web-server configuration: for Apache, add a <Files git.json.php> block with Require all denied to .htaccess; for nginx, add a location = /git.json.php { return 403; } directive. Both approaches prevent unauthenticated access without affecting other functionality. Operators should also audit the web root for other unprotected developer utility scripts (e.g., phpinfo.php, debug endpoints). Monitor the GHSA advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926 for patch releases.