CVE-2026-40908 Details
Description
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting against known CVEs), developer names and email addresses (PII), and commit messages which may contain references to internal systems or security fixes. As of time of publication, no known patched versions are available.
A vulnerability exists in WWBN AVideo versions through 29.0, where the file git.json.php in the web root executes the command git log -1 and returns the output as JSON to any unauthenticated user. This information leak exposes the deployed commit hash, allowing version fingerprinting against known CVEs, as well as developer names, email addresses, and commit messages that may reference internal systems or security fixes. The file git.json.php is a standalone PHP script that lacks authentication and session validation, making it accessible to any network client.
It is recommended to delete the git.json.php file entirely, as it serves no user-facing purpose and only exists as a development artifact. If version information is needed for administrators, it should be secured behind authentication.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 29.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |