GHSA-99J6-HJ87-6FCF
Vulnerability from github – Published: 2026-04-04 06:17 – Updated: 2026-04-07 14:20Summary
The plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.
Details
The entire file at plugin/CloneSite/client.log.php:
<?php
include '../../videos/cache/clones/client.log';
No authentication check. The log file is populated by cloneClient.json.php which writes operational details during clone operations:
// plugin/CloneSite/cloneClient.json.php:118
$log->add("Clone (2 of {$totalSteps}): Geting MySQL Dump file [$cmd]");
The $cmd variable contains wget commands with internal filesystem paths, and rsync command templates with SSH connection details (username, IP, port).
Compare with sibling endpoints:
- plugin/CloneSite/index.php checks User::isAdmin()
- plugin/CloneSite/changeStatus.json.php checks User::isAdmin()
- plugin/CloneSite/clones.json.php checks User::isAdmin()
- plugin/CloneSite/delete.json.php checks User::isAdmin()
Proof of Concept
curl "https://your-avideo-instance.com/plugin/CloneSite/client.log.php"
If the CloneSite feature has been used, the response contains wget commands, filesystem paths, SSH metadata, and SQL dump file locations.
Impact
Unauthenticated disclosure of internal infrastructure details that could aid targeted attacks against the clone source server.
Recommended Fix
Add an admin authentication check at plugin/CloneSite/client.log.php, before the include:
require_once '../../videos/configuration.php';
if (!User::isAdmin()) {
http_response_code(403);
die('Access denied');
}
Found by aisafe.io
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wwbn/avideo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "26.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35452"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-04T06:17:17Z",
"nvd_published_at": "2026-04-06T22:16:23Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nThe `plugin/CloneSite/client.log.php` endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces `User::isAdmin()`. The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.\n\n## Details\n\nThe entire file at `plugin/CloneSite/client.log.php`:\n\n```php\n\u003c?php\ninclude \u0027../../videos/cache/clones/client.log\u0027;\n```\n\nNo authentication check. The log file is populated by `cloneClient.json.php` which writes operational details during clone operations:\n\n```php\n// plugin/CloneSite/cloneClient.json.php:118\n$log-\u003eadd(\"Clone (2 of {$totalSteps}): Geting MySQL Dump file [$cmd]\");\n```\n\nThe `$cmd` variable contains wget commands with internal filesystem paths, and rsync command templates with SSH connection details (username, IP, port).\n\nCompare with sibling endpoints:\n- `plugin/CloneSite/index.php` checks `User::isAdmin()`\n- `plugin/CloneSite/changeStatus.json.php` checks `User::isAdmin()`\n- `plugin/CloneSite/clones.json.php` checks `User::isAdmin()`\n- `plugin/CloneSite/delete.json.php` checks `User::isAdmin()`\n\n## Proof of Concept\n\n```bash\ncurl \"https://your-avideo-instance.com/plugin/CloneSite/client.log.php\"\n```\n\nIf the CloneSite feature has been used, the response contains wget commands, filesystem paths, SSH metadata, and SQL dump file locations.\n\n## Impact\n\nUnauthenticated disclosure of internal infrastructure details that could aid targeted attacks against the clone source server.\n\n## Recommended Fix\n\nAdd an admin authentication check at `plugin/CloneSite/client.log.php`, before the include:\n\n```php\nrequire_once \u0027../../videos/configuration.php\u0027;\nif (!User::isAdmin()) {\n http_response_code(403);\n die(\u0027Access denied\u0027);\n}\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
"id": "GHSA-99j6-hj87-6fcf",
"modified": "2026-04-07T14:20:54Z",
"published": "2026-04-04T06:17:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-99j6-hj87-6fcf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35452"
},
{
"type": "PACKAGE",
"url": "https://github.com/WWBN/AVideo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.