CVE-2026-43877 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to videos/userPhoto/photo<users_id>.png. Its only access control is User::isLogged(). It does not end in .json.php, so it is excluded from the project's global autoCSRFGuard (which is suffix-scoped in objects/include_config.php). There is no CSRF token, no Origin/Referer check, and no MIME validation of the decoded bytes. Because AVideo's default cookie policy is SameSite=None; Secure on HTTPS (objects/functionsPHP.php:227), an attacker who lures a logged-in user to a malicious page can overwrite that user's profile photo with arbitrary bytes and also triggers a site-wide clearCache(true) on every forged request. Commit 9c38468041505e637101c5943c5370c68f48e3ac contains an updated fix.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in WWBN AVideo versions through 29.0. The issue resides in the 'objects/userSavePhoto.php' file, which serves as a legacy endpoint for profile photo updates. This endpoint accepts a base64-encoded POST parameter and saves the decoded image data to a user-specific PNG file. The only access control implemented is a check to verify if the user is logged in. However, the endpoint is excluded from the global CSRF protection mechanism, lacks proper validation of the image data, and does not include a CSRF token or Origin/Referer checks. Exploitation of this vulnerability allows an attacker to overwrite a logged-in user's profile photo with arbitrary data, while also triggering a site-wide cache clearance with each forged request.
Users can update to the patched version of AVideo, which includes validation and sanitization of image data in the user photo and background saving functions. Instructions for updating can be found in the AVideo documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 11, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-jw8g-5j46-44rp | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/WWBN/AVideo/commit/9c38468041505e637101c5943c5370c68f48e3ac | [email protected] | Source CodeVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-jw8g-5j46-44rp | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= 29.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |