Is CVE-2026-43877 actively exploited?

No active exploitation of CVE-2026-43877 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-43877 be exploited remotely?

Yes. CVE-2026-43877 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-43877?

CVE-2026-43877 has a CVSS score of 5.4 (MEDIUM).

HOME VULNERABILITIESCVE-2026-43877

MEDIUM

CVE-2026-43877

CWE-352Published: May 11, 2026· Updated: May 12, 2026

5.4

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:3.2th

Official Description

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to videos/userPhoto/photo<users_id>.png. Its only access control is User::isLogged(). It does not end in .json.php, so it is excluded from the project's global autoCSRFGuard (which is suffix-scoped in objects/include_config.php). There is no CSRF token, no Origin/Referer check, and no MIME validation of the decoded bytes. Because AVideo's default cookie policy is SameSite=None; Secure on HTTPS (objects/functionsPHP.php:227), an attacker who lures a logged-in user to a malicious page can overwrite that user's profile photo with arbitrary bytes and also triggers a site-wide clearCache(true) on every forged request. Commit 9c38468041505e637101c5943c5370c68f48e3ac contains an updated fix.

NVD Source

Technical Analysis

CVE-2026-43877 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.