Information disclosure in AVideo - CVE-2026-40908
Published: November 11, 2026
Vulnerability identifier: #VU165903
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40908
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose the deployed commit hash, developer names and email addresses, and potentially internal project information.
The vulnerability exists due to missing authentication in AVideo's git.json.php endpoint when handling requests for repository metadata. A remote attacker can send an HTTP request to /git.json.php to retrieve the full git log -1 output as JSON, fingerprint the deployed version, and read potentially sensitive commit messages.
Affected software
AVideo
How to mitigate CVE-2026-40908
Install security update from vendor's website.
AVideo - update to 29.1.0