AVideo EUVD-2026-64260

Exploitation requires that a currently authenticated AVideo administrator visit an attacker-controlled web page or load attacker-controlled content in their browser while holding an active admin session cookie - this is the UI:P (passive user interaction) condition encoded in the CVSS 4.0 vector. The vulnerable endpoint channelToGallery.json.php must be reachable from the attacker's origin, which is the case for any internet-exposed AVideo installation. No special plugin configuration beyond the default Gallery plugin presence is indicated. Limiting factors include: the attack cannot proceed without administrator-level session involvement; the endpoint only affects gallery/channel configuration, not authentication, code execution, or sensitive data; and an attacker has no direct means to force the administrator interaction without a separate social-engineering step.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L scores 5.3 (Medium), which accurately reflects the bounded real-world impact: exploitation is network-reachable and low-complexity but requires an administrator to interact with attacker-controlled content, and the resulting damage is limited to gallery configuration rather than code execution or data exfiltration. No EPSS score was provided in the intelligence data, and there is no KEV listing, meaning confirmed mass exploitation has not been observed. The integrity and availability impacts at Low level mean that while an attacker can deface the curated front page or remove gallery sections, no confidential data is exposed and the underlying platform remains operational. This places the vulnerability in the category of real but non-critical issues: it warrants patching on a normal cadence rather than emergency response, and even a mid-sized deployment should be able to address it through a standard maintenance window rather than an emergency rollout.

An attacker identifies an AVideo instance and targets its administrators via phishing or a malicious advertisement on a third-party site. When a logged-in administrator's browser loads the attacker's page, embedded JavaScript or an image tag silently issues a GET request to the target's channelToGallery.json.php endpoint, carrying the admin's session cookie, and promotes an attacker-controlled channel to the site's front page. No public proof-of-concept code has been identified, but the attack requires only basic knowledge of the endpoint URL and parameter names.