CSRF in WWBN AVideo Log Archive

Executive Summary

CVE-2026-88873 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo. It exists in the view/logArchive.json.php endpoint, which allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can trick administrators into visiting a malicious page, causing their browsers to request the endpoint. This copies sensitive logs to a publicly accessible zip file and truncates the live log to remove forensic evidence.

Useful 0 Not Useful 0

Detection Guidance

Check for unexpected zip files in the public videos/ directory of your AVideo installation. Look for files named like logArchive-*.zip. Also inspect server access logs for GET requests to /view/logArchive.json.php from unusual sources or repeated requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access sensitive application logs stored in a publicly accessible location. It also erases forensic evidence by truncating the live log, making it harder to investigate security incidents. Administrators or users with access to the system may unknowingly trigger the exploit by visiting a malicious link.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data in logs and loss of forensic evidence. GDPR requires protecting personal data, and HIPAA mandates maintaining audit logs. The truncation of logs removes critical evidence needed for compliance audits and incident response.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to a patched version that enforces POST requests with CSRF tokens for the logArchive.json.php endpoint. As a temporary workaround, restrict write permissions to the videos/ directory and block external access to /view/logArchive.json.php.

Useful 0 Not Useful 0