CVE-2026-35180: WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the site customization endpoint at admin/customizesettingsnativeUpdate.json.php lacks CSRF token validation and writes uploaded logo files to disk before the ORM's domain-based security check executes. Combined with SameSite=None cookie policy, a cross-origin POST can overwrite the platform's logo with attacker-controlled content.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35180?
CVE-2026-35180 has been classified with a Medium severity level due to its potential for CSRF exploitation leading to unauthorized actions.
How do I fix CVE-2026-35180?
To fix CVE-2026-35180, update to the latest version of WWBN AVideo that implements CSRF token validation on the site customization endpoint.
What does CVE-2026-35180 affect?
CVE-2026-35180 affects versions of WWBN AVideo up to and including 26.0 and specifically targets the site customization endpoint.
What type of vulnerability is CVE-2026-35180?
CVE-2026-35180 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the logo overwrite functionality.
Is there a workaround for CVE-2026-35180?
Currently, the only effective solution for CVE-2026-35180 is to update to a newer version of WWBN AVideo that corrects the issue.