WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

Affected: Packagist: wwbn/avideo

## Summary

The `plugin/CloneSite/client.log.php` endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces `User::isAdmin()`. The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

## Details

The entire file at `plugin/CloneSite/client.log.php`:

```php <?php include '../../videos/cache/clones/client.log'; ```

No authentication check. The log file is populated by `cloneClient.json.php` which writes operational details during clone operations:

```php // plugin/CloneSite/cloneClient.json.php:118 $log->add("Clone (2 of {$totalSteps}): Geting MySQL Dump file [$cmd]"); ```

The `$cmd` variable contains wget commands with internal filesystem paths, and rsync command templates with SSH connection details (username, IP, port).

Compare with sibling endpoints: - `plugin/CloneSite/index.php` checks `User::isAdmin()` - `plugin/CloneSite/changeStatus.json.php` checks `User::isAdmin()` - `plugin/CloneSite/clones.json.php` checks `User::isAdmin()` - `plugin/CloneSite/delete.json.php` checks `User::isAdmin()`

## Proof of Concept

```bash curl "https://your-avideo-instance.com/plugin/CloneSite/client.log.php" ```

If the CloneSite feature has been used, the response contains wget commands, filesystem paths, SSH metadata, and SQL dump file locations.

## Impact

Unauthenticated disclosure of internal infrastructure details that could aid targeted attacks against the clon…