PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35180 WWBN CVE debrief

The AVideo platform version 26.0 and prior contain a vulnerability enabling cross-origin POST to overwrite platform logo. The site customization endpoint at admin/customize_settings_nativeUpdate.json.php lacks CSRF token validation and writes uploaded logo files to disk before the ORM's domain-based security check executes. Combined with SameSite=None cookie policy, an attacker can overwrite the platform's logo with attacker-controlled content.

Vendor
WWBN
Product
AVideo
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Security teams and administrators responsible for AVideo installations should assess and mitigate CVE-2026-35180. This medium-severity vulnerability enables an attacker to overwrite platform logo via cross-origin POST requests.

Technical summary

CVE-2026-35180 is a medium-severity vulnerability in AVideo versions 26.0 and prior. The site customization endpoint at admin/customize_settings_nativeUpdate.json.php is vulnerable to CSRF attacks, allowing an attacker to overwrite the platform's logo with attacker-controlled content via cross-origin POST requests. The vulnerability is due to the lack of CSRF token validation and the fact that uploaded logo files are written to disk before the ORM's domain-based security check executes. The vulnerability is exacerbated by the SameSite=None cookie policy.

Defensive priority

Apply patches or mitigations to prevent exploitation of CVE-2026-35180. Ensure CSRF token validation is implemented and SameSite cookie policy is set to a more secure value.

Recommended defensive actions

  • Implement CSRF token validation for the site customization endpoint
  • Restrict logo uploads to trusted sources
  • Monitor for suspicious logo changes
  • Update AVideo to a version that fixes the vulnerability
  • Configure SameSite cookie policy to a more secure value

Evidence notes

The CVE record was published on 2026-04-06T20:16:26.237Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. Evidence from CVE.org and NVD detail indicate a medium-severity vulnerability in AVideo versions 26.0 and prior, enabling cross-origin POST to overwrite platform logo due to lack of CSRF token validation and SameSite=None cookie policy. Defenders should verify AVideo installations, assess exposure, and apply patches or mitigations. Further verification tasks include reviewing official advisories, tracking exceptions, and retesting remediated assets.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35180 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35180

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35180 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35180

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.