Vulnerability-Lookup

CVE-2026-40908 (GCVE-0-2026-40908)

Vulnerability from cvelistv5 – Published: 2026-04-21 19:52 – Updated: 2026-04-22 13:25

Title

WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version

Summary

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting against known CVEs), developer names and email addresses (PII), and commit messages which may contain references to internal systems or security fixes. As of time of publication, no known patched versions are available.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

URL

Tags

https://github.com/WWBN/AVideo/security/advisorie…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	WWBN	AVideo	Affected: <= 29.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40908",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T13:25:23.403258Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T13:25:57.077Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 29.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting against known CVEs), developer names and email addresses (PII), and commit messages which may contain references to internal systems or security fixes. As of time of publication, no known patched versions are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T19:52:34.204Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926"
        }
      ],
      "source": {
        "advisory": "GHSA-52hf-63q4-r926",
        "discovery": "UNKNOWN"
      },
      "title": "WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40908",
    "datePublished": "2026-04-21T19:52:34.204Z",
    "dateReserved": "2026-04-15T16:37:22.767Z",
    "dateUpdated": "2026-04-22T13:25:57.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-40908",
      "date": "2026-04-23",
      "epss": "0.00031",
      "percentile": "0.08858"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-40908\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-21T20:17:03.220\",\"lastModified\":\"2026-04-23T19:09:57.590\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting against known CVEs), developer names and email addresses (PII), and commit messages which may contain references to internal systems or security fixes. As of time of publication, no known patched versions are available.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"29.0\",\"matchCriteriaId\":\"AC38CA07-71C1-4C86-B84A-83CF96367CBA\"}]}]}],\"references\":[{\"url\":\"https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-40908\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-22T13:25:23.403258Z\"}}}], \"references\": [{\"url\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-22T13:25:52.018Z\"}}], \"cna\": {\"title\": \"WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version\", \"source\": {\"advisory\": \"GHSA-52hf-63q4-r926\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"WWBN\", \"product\": \"AVideo\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 29.0\"}]}], \"references\": [{\"url\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926\", \"name\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting against known CVEs), developer names and email addresses (PII), and commit messages which may contain references to internal systems or security fixes. As of time of publication, no known patched versions are available.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-21T19:52:34.204Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-40908\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-22T13:25:57.077Z\", \"dateReserved\": \"2026-04-15T16:37:22.767Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-21T19:52:34.204Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-52HF-63Q4-R926

Vulnerability from github – Published: 2026-04-14 22:49 – Updated: 2026-04-14 22:49

Summary

WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version

Details

Summary

The file git.json.php at the web root executes git log -1 and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting against known CVEs), developer names and email addresses (PII), and commit messages which may contain references to internal systems or security fixes.

Details

git.json.php is a standalone PHP script with no authentication, no session validation, and no framework bootstrap. It directly executes a shell command and returns the result:

// git.json.php — complete file
<?php
header('Content-Type: application/json');
$cmd = "git log -1";
exec($cmd . "  2>&1", $output, $return_val);

$obj = new stdClass();
$obj->output = $output;

foreach ($output as $value) {
    preg_match("/Date:(.*)/i", $value, $match);
    if (!empty($match[1])) {
        $obj->date = strtotime($match[1]);
        $obj->dateString = trim($match[1]);
        $obj->dateMySQL = date("Y-m-d H:i:s", $obj->date);
    }
}

echo json_encode($obj);

The file does not require any configuration or authentication module. It is not protected by .htaccess rules. The endpoint is directly accessible to any network client.

The exposed data enables: 1. Version fingerprinting: The commit hash identifies the exact deployed version, allowing attackers to cross-reference the project's public git history against known CVEs (AVideo has 22 published GHSAs) to determine which vulnerabilities remain unpatched on a given instance. 2. Developer PII leakage: Author name and email from the git commit are exposed. On self-hosted instances, this may reveal internal/corporate email addresses not otherwise publicly available. 3. Commit message intelligence: Commit messages may reference internal bug trackers, security fixes in progress, or infrastructure details.

PoC

# Single unauthenticated request — no cookies, no headers needed
curl -s https://target.example/git.json.php | python3 -m json.tool

Verified response from test instance:

{
    "output": [
        "commit 80a8af96e861cff45cd80fdd2478d00b2c07749e",
        "Author: Daniel Neto <me@danielneto.com>",
        "Date:   Wed Apr 8 16:07:23 2026 -0300",
        "",
        "    fix: Update payment response handling to include transaction token and URL"
    ],
    "date": 1775675243,
    "dateString": "Wed Apr 8 16:07:23 2026 -0300",
    "dateMySQL": "2026-04-08 19:07:23"
}

Impact

Any unauthenticated remote attacker can determine the exact deployed version and identify which known CVEs (22 published GHSAs for AVideo) apply to the target instance.
Developer email addresses are leaked, enabling targeted phishing or social engineering against project maintainers and contributors.
Commit messages may disclose internal project details, security fix status, or infrastructure information.

Recommended Fix

Delete git.json.php entirely — it serves no user-facing purpose and exists only as a development/debug artifact:

rm git.json.php

If version display is needed for administrators, gate it behind authentication:

<?php
require_once 'videos/configuration.php';
if (!User::isAdmin()) {
    header('HTTP/1.1 403 Forbidden');
    die(json_encode(['error' => 'Forbidden']));
}
header('Content-Type: application/json');
$cmd = "git log -1";
exec($cmd . "  2>&1", $output, $return_val);

$obj = new stdClass();
$obj->output = $output;

foreach ($output as $value) {
    preg_match("/Date:(.*)/i", $value, $match);
    if (!empty($match[1])) {
        $obj->date = strtotime($match[1]);
        $obj->dateString = trim($match[1]);
        $obj->dateMySQL = date("Y-m-d H:i:s", $obj->date);
    }
}

echo json_encode($obj);

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T22:49:25Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting against known CVEs), developer names and email addresses (PII), and commit messages which may contain references to internal systems or security fixes.\n\n## Details\n\n`git.json.php` is a standalone PHP script with no authentication, no session validation, and no framework bootstrap. It directly executes a shell command and returns the result:\n\n```php\n// git.json.php \u2014 complete file\n\u003c?php\nheader(\u0027Content-Type: application/json\u0027);\n$cmd = \"git log -1\";\nexec($cmd . \"  2\u003e\u00261\", $output, $return_val);\n\n$obj = new stdClass();\n$obj-\u003eoutput = $output;\n\nforeach ($output as $value) {\n    preg_match(\"/Date:(.*)/i\", $value, $match);\n    if (!empty($match[1])) {\n        $obj-\u003edate = strtotime($match[1]);\n        $obj-\u003edateString = trim($match[1]);\n        $obj-\u003edateMySQL = date(\"Y-m-d H:i:s\", $obj-\u003edate);\n    }\n}\n\necho json_encode($obj);\n```\n\nThe file does not `require` any configuration or authentication module. It is not protected by `.htaccess` rules. The endpoint is directly accessible to any network client.\n\nThe exposed data enables:\n1. **Version fingerprinting**: The commit hash identifies the exact deployed version, allowing attackers to cross-reference the project\u0027s public git history against known CVEs (AVideo has 22 published GHSAs) to determine which vulnerabilities remain unpatched on a given instance.\n2. **Developer PII leakage**: Author name and email from the git commit are exposed. On self-hosted instances, this may reveal internal/corporate email addresses not otherwise publicly available.\n3. **Commit message intelligence**: Commit messages may reference internal bug trackers, security fixes in progress, or infrastructure details.\n\n## PoC\n\n```bash\n# Single unauthenticated request \u2014 no cookies, no headers needed\ncurl -s https://target.example/git.json.php | python3 -m json.tool\n```\n\nVerified response from test instance:\n```json\n{\n    \"output\": [\n        \"commit 80a8af96e861cff45cd80fdd2478d00b2c07749e\",\n        \"Author: Daniel Neto \u003cme@danielneto.com\u003e\",\n        \"Date:   Wed Apr 8 16:07:23 2026 -0300\",\n        \"\",\n        \"    fix: Update payment response handling to include transaction token and URL\"\n    ],\n    \"date\": 1775675243,\n    \"dateString\": \"Wed Apr 8 16:07:23 2026 -0300\",\n    \"dateMySQL\": \"2026-04-08 19:07:23\"\n}\n```\n\n## Impact\n\n- Any unauthenticated remote attacker can determine the exact deployed version and identify which known CVEs (22 published GHSAs for AVideo) apply to the target instance.\n- Developer email addresses are leaked, enabling targeted phishing or social engineering against project maintainers and contributors.\n- Commit messages may disclose internal project details, security fix status, or infrastructure information.\n\n## Recommended Fix\n\nDelete `git.json.php` entirely \u2014 it serves no user-facing purpose and exists only as a development/debug artifact:\n\n```bash\nrm git.json.php\n```\n\nIf version display is needed for administrators, gate it behind authentication:\n\n```php\n\u003c?php\nrequire_once \u0027videos/configuration.php\u0027;\nif (!User::isAdmin()) {\n    header(\u0027HTTP/1.1 403 Forbidden\u0027);\n    die(json_encode([\u0027error\u0027 =\u003e \u0027Forbidden\u0027]));\n}\nheader(\u0027Content-Type: application/json\u0027);\n$cmd = \"git log -1\";\nexec($cmd . \"  2\u003e\u00261\", $output, $return_val);\n\n$obj = new stdClass();\n$obj-\u003eoutput = $output;\n\nforeach ($output as $value) {\n    preg_match(\"/Date:(.*)/i\", $value, $match);\n    if (!empty($match[1])) {\n        $obj-\u003edate = strtotime($match[1]);\n        $obj-\u003edateString = trim($match[1]);\n        $obj-\u003edateMySQL = date(\"Y-m-d H:i:s\", $obj-\u003edate);\n    }\n}\n\necho json_encode($obj);\n```",
  "id": "GHSA-52hf-63q4-r926",
  "modified": "2026-04-14T22:49:25Z",
  "published": "2026-04-14T22:49:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version"
}

FKIE_CVE-2026-40908

Vulnerability from fkie_nvd - Published: 2026-04-21 20:17 - Updated: 2026-04-23 19:09

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926	Exploit, Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	wwbn	avideo	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC38CA07-71C1-4C86-B84A-83CF96367CBA",
              "versionEndIncluding": "29.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting against known CVEs), developer names and email addresses (PII), and commit messages which may contain references to internal systems or security fixes. As of time of publication, no known patched versions are available."
    }
  ],
  "id": "CVE-2026-40908",
  "lastModified": "2026-04-23T19:09:57.590",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-21T20:17:03.220",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-52hf-63q4-r926"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-40908 (GCVE-0-2026-40908)

GHSA-52HF-63Q4-R926

Summary

Details

PoC

Impact

Recommended Fix

FKIE_CVE-2026-40908

Tags

Sightings

Nomenclature