CVE-2026-40908

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file "git.json.php" at the web root executes "git log -1" and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash enabling version fingerprinting against known CVEs,...