CVE-2026-57944: AVideo channelToGallery.json.php Cross-Site Request Forgery
AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Gallery configuration by performing unauthorized writes to plugin data. Attackers can craft a cross-site GET request carrying an administrator's session cookie to promote arbitrary channels to the front page or delete curated sections without token validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideo channelToGallery.json.phpto a version that resolves this vulnerability.Patch 9c39d8c8
Event History
Frequently Asked Questions
What does an attacker need to successfully exploit this issue?
The attacker must induce an authenticated AVideo administrator to load a crafted cross-site GET request. The administrator's active session cookie is used to authorize the unauthorized plugin-data write.
What changes can an attacker make through a successful request?
An attacker can modify site-wide Gallery configuration, including promoting arbitrary channels to the front page or deleting curated sections.