CVE-2026-35180 WWBN CVE debrief

Who should care

Security teams and administrators responsible for AVideo installations should assess and mitigate CVE-2026-35180. This medium-severity vulnerability enables an attacker to overwrite platform logo via cross-origin POST requests.

Technical summary

CVE-2026-35180 is a medium-severity vulnerability in AVideo versions 26.0 and prior. The site customization endpoint at admin/customize_settings_nativeUpdate.json.php is vulnerable to CSRF attacks, allowing an attacker to overwrite the platform's logo with attacker-controlled content via cross-origin POST requests. The vulnerability is due to the lack of CSRF token validation and the fact that uploaded logo files are written to disk before the ORM's domain-based security check executes. The vulnerability is exacerbated by the SameSite=None cookie policy.

Defensive priority

Apply patches or mitigations to prevent exploitation of CVE-2026-35180. Ensure CSRF token validation is implemented and SameSite cookie policy is set to a more secure value.

Recommended defensive actions

• Implement CSRF token validation for the site customization endpoint
• Restrict logo uploads to trusted sources
• Monitor for suspicious logo changes
• Update AVideo to a version that fixes the vulnerability
• Configure SameSite cookie policy to a more secure value

Evidence notes

The CVE record was published on 2026-04-06T20:16:26.237Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. Evidence from CVE.org and NVD detail indicate a medium-severity vulnerability in AVideo versions 26.0 and prior, enabling cross-origin POST to overwrite platform logo due to lack of CSRF token validation and SameSite=None cookie policy. Defenders should verify AVideo installations, assess exposure, and apply patches or mitigations. Further verification tasks include reviewing official advisories, tracking exceptions, and retesting remediated assets.

Official resources