CVE-2026-35452: AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

April 4, 2026 (updated April 7, 2026)

The plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/security/advisories/GHSA-99j6-hj87-6fcf
github.com/advisories/GHSA-99j6-hj87-6fcf
nvd.nist.gov/vuln/detail/CVE-2026-35452

Code Behaviors & Features

Detect and mitigate CVE-2026-35452 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →