PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-58001 WWBN CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-22T13:16:38.403Z and has not been modified since then. CVE-2026-58001 is a medium-severity cross-site request forgery vulnerability in WWBN AVideo's videoEditLight.php. The vulnerability allows attackers to store an img tag in a video description that can transfer video ownership to an attacker-controlled account when an administrator views the video page. The vulnerability has a CVSS score of 6.9 and is classified as CWE-352. AVideo installations should be reviewed for potential exposure, and compensating controls should be implemented for video ownership transfers. Limited details on exploitability and affected versions are available. Defenders should verify video description fields for suspicious img tags and monitor video ownership transfers. Administrators and users of WWBN AVideo, especially those with administrative privileges, should be aware of this vulnerability and take necessary precautions to prevent exploitation.

Vendor
WWBN
Product
AVideo
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-22
Original CVE updated
2026-08-26
Advisory published
2026-08-22
Advisory updated
2026-08-26

Who should care

Administrators and users of WWBN AVideo, especially those with administrative privileges, should be aware of this vulnerability and take necessary precautions to prevent exploitation. AVideo operators, platform administrators, and security teams should review and apply vendor remediation for the CSRF vulnerability in videoEditLight.php, inventory AVideo installations for potential exposure, and monitor video description fields for suspicious img tags.

Technical summary

CVE-2026-58001 is a medium-severity cross-site request forgery vulnerability in WWBN AVideo's videoEditLight.php. The vulnerability allows attackers to store an img tag in a video description that can transfer video ownership to an attacker-controlled account when an administrator views the video page. The vulnerability has a CVSS score of 6.9 and is classified as CWE-352. AVideo installations should be reviewed for potential exposure, and compensating controls should be implemented for video ownership transfers.

Defensive priority

Medium-priority defensive review recommended due to CSRF vulnerability in videoEditLight.php of WWBN AVideo, allowing attackers to transfer video ownership via img tags in video descriptions.

Recommended defensive actions

  • Review and apply vendor remediation for CSRF vulnerability in videoEditLight.php
  • Inventory AVideo installations for potential exposure
  • Monitor video description fields for suspicious img tags
  • Implement compensating controls for video ownership transfers
  • Exception tracking for videoEditLight.php usage

Evidence notes

Evidence from official CVE and NVD sources indicates a cross-site request forgery vulnerability in WWBN AVideo's videoEditLight.php. Limited details on exploitability and affected versions are available. The vulnerability allows attackers to store an img tag in a video description that can transfer video ownership to an attacker-controlled account when an administrator views the video page. Defenders should verify video description fields for suspicious img tags and monitor video ownership transfers.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-58001 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-58001

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-58001 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-58001

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.