https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T10:52:24.302099+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-277831 EUVD-2026-277831 2026-10-19T10:52:24.304456+00:00 EUVD-2026-277831 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34247 fkie_cve-2026-34247 2026-10-19T10:52:24.304486+00:00

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Live/uploadPoster.php` endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary `live_schedule_id`. The endpoint only checks `User::isLogged()` but never verifies that the authenticated user owns the targeted schedule. After overwriting the poster, the endpoint broadcasts a `socketLiveOFFCallback` notification containing the victim's broadcast key and user ID to all connected WebSocket clients. Commit 5fcb3bdf59f26d65e203cfbc8a685356ba300b60 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-g3hj-mf85-679g GHSA-g3hj-mf85-679g — AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger F… 2026-10-19T10:52:24.304519+00:00

Affected: Packagist: wwbn/avideo

## Summary

The `plugin/Live/uploadPoster.php` endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary `live_schedule_id`. The endpoint only checks `User::isLogged()` but never verifies that the authenticated user owns the targeted schedule. After overwriting the poster, the endpoint broadcasts a `socketLiveOFFCallback` notification containing the victim's broadcast key and user ID to all connected WebSocket clients.

## Details

The vulnerable endpoint at `plugin/Live/uploadPoster.php` accepts a `live_schedule_id` from `$_REQUEST` and uses it to determine poster file paths and trigger socket notifications without ownership validation.

**Entry point — attacker-controlled input (line 11-12):** ```php $live_servers_id = intval($_REQUEST['live_servers_id']); $live_schedule_id = intval($_REQUEST['live_schedule_id']); ```

**Insufficient auth check (line 14-17):** ```php if (!User::isLogged()) { $obj->msg = 'You cant edit this file'; die(json_encode($obj)); } ```

This only verifies the user is logged in. There is no check that `User::getId()` matches the schedule owner's `users_id`.

**Poster path resolved by ID alone (line 40-42):** ```php $paths = Live_schedule::getPosterPaths($live_schedule_id, 0); $obj->file = str_replace($global['systemRootPath'], '', $paths['path']); $obj->fileThumbs = str_replace($global['systemRootPath'], '', $paths['path_thumbs']); ```

`getPosterPaths()` is a static method th…