CVE-2026-40908

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting against known CVEs), developer names and email addresses (PII), and commit messages which may contain references to internal systems or security fixes. As of time of publication, no known patched versions are available.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926	Exploit Vendor Advisory
https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) WWBN AVideo es una plataforma de video de código abierto. En las versiones 29.0 y anteriores, el archivo ’git.json.php’ en la raíz web ejecuta ’git log -1’ y devuelve la salida completa como JSON a cualquier usuario no autenticado. Esto expone el hash de commit exacto desplegado (lo que permite la identificación de versiones (fingerprinting) contra CVEs conocidos), nombres de desarrolladores y direcciones de correo electrónico (PII), y mensajes de commit que pueden contener referencias a sistemas internos o correcciones de seguridad. Al momento de la publicación, no hay versiones parcheadas conocidas disponibles.

Information

Published : 2026-04-21 20:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40908

Mitre link : CVE-2026-40908

CVE.ORG link : CVE-2026-40908

JSON object : View

Products Affected

wwbn

avideo

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-40908", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40908", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T13:25:23.403258Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 29.0"}]}]}], "published": "2026-04-21T20:17:03.220", "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting against known CVEs), developer names and email addresses (PII), and commit messages which may contain references to internal systems or security fixes. As of time of publication, no known patched versions are available."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En las versiones 29.0 y anteriores, el archivo \u2019git.json.php\u2019 en la ra\u00edz web ejecuta \u2019git log -1\u2019 y devuelve la salida completa como JSON a cualquier usuario no autenticado. Esto expone el hash de commit exacto desplegado (lo que permite la identificaci\u00f3n de versiones (fingerprinting) contra CVEs conocidos), nombres de desarrolladores y direcciones de correo electr\u00f3nico (PII), y mensajes de commit que pueden contener referencias a sistemas internos o correcciones de seguridad. Al momento de la publicaci\u00f3n, no hay versiones parcheadas conocidas disponibles."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC38CA07-71C1-4C86-B84A-83CF96367CBA", "versionEndIncluding": "29.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}