PatchSiren cyber security CVE debrief

CVE-2026-19075 All-in-One Video Gallery CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-10T07:16:51.260Z and has not been modified since then. The All-in-One Video Gallery plugin has a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester. This vulnerability allows unauthenticated file downloads, potentially leading to sensitive information disclosure. Users of the plugin should review and update their configuration to prevent unauthenticated file downloads. Defenders should verify the plugin version and configuration for public, unauthenticated file-download handler vulnerability. They should also monitor for suspicious file download requests and confirm whether affected product deployments exist in managed environments.

Vendor: All-in-One Video Gallery
Product: All-in-One Video Gallery
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-08-10
Original CVE updated: 2026-08-10
Advisory published: 2026-08-10
Advisory updated: 2026-08-10

Who should care

Users of the All-in-One Video Gallery plugin should review and update their configuration to prevent unauthenticated file downloads. This vulnerability affects operators who use the plugin, as well as security teams and vulnerability management teams who need to ensure the security of their systems. Platform administrators and security personnel should also be aware of this vulnerability and take necessary precautions to protect their systems.

Technical summary

The All-in-One Video Gallery plugin has a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post. The handler reads the post's `mp4` meta value and streams that URL's response back to the requester. This vulnerability allows unauthenticated file downloads, potentially leading to sensitive information disclosure. Users of the plugin should review and update their configuration to prevent unauthenticated file downloads.

Defensive priority

Low-priority review of All-in-One Video Gallery plugin for unauthenticated file-download handler vulnerability.

Recommended defensive actions

Review All-in-One Video Gallery plugin configuration for public, unauthenticated file-download handler.
Verify plugin version and update if necessary.
Monitor for suspicious file download requests.
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The evidence for this CVE is limited. The CVE record was published on 2026-08-10T07:16:51.260Z and has not been modified since then. The All-in-One Video Gallery plugin has a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post. The handler reads the post's `mp4` meta value and streams that URL's response back to the requester. Defenders should verify the plugin version and configuration for public, unauthenticated file-download handler vulnerability. They should also monitor for suspicious file download requests.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-10T07:16:51.260Z and has not been modified since then.