Medium severity5.4NVD Advisory· Published Aug 22, 2026

CVE-2026-57944

Description

AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Gallery configuration by performing unauthorized writes to plugin data. Attackers can craft a cross-site GET request carrying an administrator's session cookie to promote arbitrary channels to the front page or delete curated sections without token validation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

AVideo/AVideollm-fuzzy
Range: <=commit 9c39d8c8

Patches

Vulnerability mechanics

References

github.com/WWBN/AVideo/security/advisories/GHSA-8qq4-h7xj-p2c4nvd
www.vulncheck.com/advisories/avideo-channeltogallery-json-php-cross-site-request-forgerynvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000