p PatchFirst

CVE-2026-35450

CVE-2026-35450 · WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

This page contains facts from public vulnerability sources. Check the original advisory before updating.

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().

CVSS 5.3 · Medium · EPSS 0.4%

Published
Updated

Stack: php

Affected products and versions

  • avideo

    Versions
    • <= 26.0: Affected

    No fix published

  • wwbn/avideo Packagist

    Versions
    • 10.4
    • 10.8
    • 11
    • 11.1
    • 11.1.1
    • 11.5
    • 11.6
    • 12.4
    • 14.3
    • 14.3.1
    • 14.4
    • 18.0
    • 21.0
    • 22.0
    • 24.0
    • 25.0
    • 26.0
    Affected ranges
    • ECOSYSTEM: ≤ 26.0

    No fix published

Original sources

Check your server →