平台
php
组件
avideo
修复版本
29.0.1
CVE-2026-40928 describes a Cross-Site Request Forgery (CSRF) vulnerability affecting AVideo versions 1.0.0 through 29.0. This flaw allows an attacker to perform actions on behalf of an authenticated user without their knowledge, potentially leading to unauthorized modifications of content and user data. The vulnerability stems from a lack of CSRF protection on several JSON endpoints within the objects/ directory. A fix is available in version 29.1.
The impact of CVE-2026-40928 is significant due to the ease of exploitation and the potential for widespread impact. An attacker could craft a malicious webpage that, when visited by a logged-in AVideo user, silently executes actions such as altering comment likes/dislikes, posting comments with attacker-controlled text, and even deleting assets if the user possesses the necessary permissions. This could result in reputational damage, data manipulation, and disruption of service. The ability to post comments as the victim opens the door for phishing attacks and spreading misinformation. The blast radius extends to all users of affected AVideo installations, particularly those with administrative or content management privileges.
CVE-2026-40928 was published on 2026-04-21. The vulnerability's ease of exploitation and potential impact suggest a medium probability of exploitation. No public Proof-of-Concept (PoC) code has been publicly released as of this writing, but the vulnerability's nature makes it likely that PoCs will emerge. It is not currently listed on KEV or associated with any known active exploitation campaigns. Refer to the official AVideo advisory for further details.
漏洞利用状态
EPSS
0.02% (5% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2026-40928 is to upgrade AVideo to version 29.1 or later, which includes the necessary CSRF protections. If immediate upgrading is not feasible, consider implementing temporary workarounds. These may include implementing strict Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed, and adding referer checks to the vulnerable endpoints. Web Application Firewalls (WAFs) can be configured to detect and block suspicious requests targeting the affected JSON endpoints. After upgrading, verify the fix by attempting to trigger the vulnerable actions from a different browser session or incognito window to confirm that CSRF protection is now in place.
Actualice el plugin AVideo a la versión 29.1 o superior para mitigar la vulnerabilidad. Esta actualización implementa medidas de seguridad para prevenir la manipulación de comentarios, votos y la eliminación de activos a través de solicitudes CSRF.
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2026-40928 is a Cross-Site Request Forgery (CSRF) vulnerability in AVideo versions 1.0.0 through 29.0, allowing attackers to perform actions as logged-in users without their consent.
If you are using AVideo versions 1.0.0 through 29.0, you are potentially affected by this vulnerability. Upgrade to version 29.1 or later to mitigate the risk.
The recommended fix is to upgrade AVideo to version 29.1 or later. As a temporary workaround, implement CSP headers and referer checks.
No public exploitation campaigns have been reported as of this writing, but the vulnerability's ease of exploitation suggests a potential risk.
Refer to the official AVideo security advisory for detailed information and updates regarding CVE-2026-40928.