Avideo EUVD-2026-19454

The CVSS v3.1 score of 4.3 reflects low real-world risk due to user interaction (UI:R) requirement and limited impact scope (integrity only, no confidentiality or availability). The CVSS vector AV:N/AC:L/PR:N/UI:R indicates the attack requires network access but no authentication; however, the UI:R flag means a legitimate user must visit an attacker-controlled page in the same browser session. The attack surface is narrow (site logo overwrite), and the integrity impact is non-critical compared to data exfiltration or service disruption. This is a textbook low-severity CSRF: while the technical prerequisites are present (missing token validation, SameSite=None), the practical harm is reputational rather than operational. An attacker cannot steal data, escalate privileges, or disrupt core platform function-only deface the visual branding. The lack of a documented POC or KEV status further indicates this is not an active exploitation priority in the wild.

An attacker creates a malicious webpage containing a form that, when visited by an authenticated AVideo administrator, automatically submits a cross-origin POST request to the target AVideo instance's admin/customize_settings_nativeUpdate.json.php endpoint with a crafted logo file attachment. Because the endpoint lacks CSRF token validation and the SameSite cookie is set to None, the browser includes the administrator's session cookie in the cross-origin request. The endpoint writes the attacker's logo to disk before the ORM's security check runs, resulting in the platform's visual branding being replaced with attacker-controlled content (e.g., a defaced logo). The administrator sees the change only after logging back in or refreshing the admin panel; the attacker gains no data access or control beyond logo replacement.