CVE-2026-88873: WWBN AVideo Cross-Site Request Forgery via logArchive.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrators' browsers to request the endpoint, copying sensitive application logs to a publicly accessible zip file and truncating the live log to remove forensic evidence.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideoto a version that resolves this vulnerability.Fixed in c3edcc274c389816d434acadac07ee78eaf330c1Patch WWBN AVideo Cross-Site Request Forgery via logArchive.json.php - Configuration
Modify view/logArchive.json.php so GET requests to the log archiving functionality validate a CSRF token (prevent unauthenticated attackers from archiving logs via GET without CSRF token validation).
AVideo view/logArchive.json.php CSRF token validation for log archiving endpoint = enabled
Event History
Frequently Asked Questions
Who is exposed to this issue?
AVideo installations that include the affected code through commit c3edcc274c389816d434acadac07ee78eaf330c1 are exposed if an administrator can be induced to visit an attacker-controlled page. The attack is network-delivered and does not require the attacker to authenticate.
What does an attacker need to exploit it?
The attacker needs to craft a malicious page that causes an administrator's browser to send a GET request to view/logArchive.json.php. Exploitation depends on administrator interaction, because the request is made in the administrator's browser session.
What is the impact of a successful request?
The endpoint can archive application logs into a publicly accessible ZIP file, potentially exposing sensitive log contents. It also truncates the live log, which can remove forensic evidence.
How can I determine whether my installation is affected?
Check whether your AVideo code includes view/logArchive.json.php and is at or before the referenced commit c3edcc274c389816d434acadac07ee78eaf330c1. Also review whether the endpoint accepts GET requests without CSRF token validation and whether archived log ZIP files are publicly accessible.