CVE-2026-39369
CVE-2026-39369 · WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs
This page contains facts from public vulnerability sources. Check the original advisory before updating.
WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storage path. The vulnerable GIF branch could be abused to read local files such as /etc/passwd or application source files and republish those bytes through a normal public GIF media URL.
CVSS 7.6 · High · EPSS 0.4%
- Published
- Updated
Stack: php
Affected products and versions
avideo
- Versions
- <= 26.0: Affected
No fix published
wwbn/avideo Packagist
- Affected ranges
- ECOSYSTEM: ≤ 26.0
No fix published