CVE-2026-45731

CVE-2026-45731 · WWBN AVideo: Authenticated Arbitrary File Read in view/update.php

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

WWBN AVideo is an open source video platform. In 29.0 and earlier, view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.

CVSS 6.9 · Moyenne · EPSS 0,5%

Publication

2026-05-29T13:05:02.855Z

Mise à jour

2026-05-29T14:03:09.980Z

Pile logicielle: php

Vérifiez votre serveur →