CVE-2026-35449: WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php
Summary
The install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.
Details
The disabled guard at install/test.php:5-7:
php if (!isCommandLineInterface()) { //return die('Command Line only'); }
The script also enables verbose error reporting:
php errorreporting(EALL); iniset('displayerrors', '1');
It then queries VideoStatistic::getLastStatistics() and outputs the result via vardump():
php $resp = VideoStatistic::getLastStatistics(getVideosid(), User::getId()); vardump($resp);
The VideoStatistic object contains: ip (viewer IP address), sessionid, useragent, usersid, and JSON metadata. The displayerrors=1 setting also leaks internal filesystem paths in any PHP warnings.
The install/ directory is not restricted by .htaccess (it only disables directory listing via Options -Indexes) and no web server rules block access to individual PHP files in this directory.
Proof of Concept
bash Request viewer stats for video ID 1 curl "https://your-avideo-instance.com/install/test.php?videosid=1"
Confirmed accessible on live AVideo instances (HTTP 200).
Impact
Unauthenticated disclosure of viewer IP addresses (PII under GDPR), session identifiers, and user agents. The enabled displayerrors also reveals internal server paths on errors.
- CWE: CWE-200 (Exposure of Sensitive Information) - Severity: Low
Recommended Fix
Uncomment the CLI guard at install/test.php:6 to restore the intended access restriction:
php if (!isCommandLineInterface()) { return die('Command Line only'); }
--- Found by aisafe.io
Other sources
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Edit install/test.php and restore the CLI-only access restriction by uncommenting the die('Command Line only') statement at install/test.php:6 (the script’s CLI guard is currently disabled, allowing HTTP access and disclosure).
AVideo (install/test.php diagnostic script) CLI-only access guard (die('Command Line only')) = Uncomment die() so non-CLI requests are blocked - Configuration
Set PHP display_errors to '0' (the script sets display_errors to '1', which leaks internal filesystem paths in warnings/errors).
AVideo/PHP display_errors = 0 (disabled) - Compensating control
Block public HTTP access to the install/ directory (and/or to install/test.php) using web server access controls, since install/ has only Options -Indexes and does not restrict individual PHP files; configure rules so unauthenticated users cannot reach install/test.php.