CVE-2026-19075

All-in-One Video Gallery (affected: versions prior to 4.9.2) contains an unauthenticated file-download handler accessible via the vdl parameter on aiovg_videos posts. The underlying code path in AIOVG_Public_Video::download_video() reads the post’s mp4 meta value and streams that URL’s response b...