WWBN AVideo EUVD-2026-75423

Exploitation requires that a logged-in AVideo administrator with an active session visits an attacker-controlled web page or loads attacker-supplied content in their browser. The endpoint view/logArchive.json.php must be reachable from the attacker's crafted page (i.e., not blocked by same-origin policy on the GET response, which is not required for CSRF trigger). No special server configuration, plugin, or non-default feature needs to be enabled - the log-archive endpoint is present in all affected versions by default. Exploitation is limited by the need for the attacker to successfully deliver the malicious page to an active administrator session; there is no path to direct server-side exploitation without administrator participation.

The CVSS 4.0 score of 7.1 reflects the combination of network reachability (AV:N), low complexity (AC:L), and high confidentiality impact (VC:H), tempered by the user-interaction prerequisite (UI:P - passive interaction, meaning the admin need only load a page). The confidentiality impact is credibly High because application logs can expose session tokens, user activity, and internal error details. The availability impact (VA:L) represents loss of forensic log data via truncation, which can compound incident response difficulty. There is no CISA KEV listing and no public POC, so real-world exploitation risk is moderate rather than critical. The attack is straightforward to craft but requires the attacker to succeed in causing an authenticated administrator to visit attacker-controlled content, which is a meaningful social-engineering barrier. EPSS data is absent from the input; given the niche deployment footprint and the social-engineering requirement, opportunistic mass exploitation is unlikely.

An attacker targeting an AVideo instance embeds a hidden <img src='https://target.avideo.example.com/view/logArchive.json.php'> tag in a spear-phishing email or on a compromised site that an AVideo administrator visits while logged in. The administrator's browser silently issues the GET request authenticated by their session cookie, causing the server to compress sensitive application logs into a publicly downloadable zip. The attacker retrieves the zip - potentially containing session identifiers and internal error traces - while the live log is truncated, removing evidence of any prior compromise.