CVE-2026-45731
CVE-2026-45731 · WWBN AVideo: Authenticated Arbitrary File Read in view/update.php
This page contains facts from public vulnerability sources. Check the original advisory before updating.
WWBN AVideo is an open source video platform. In 29.0 and earlier, view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.
CVSS 6.9 · Medium · EPSS 0.5%
- Published
- Updated
Stack: php
Affected products and versions
avideo
- Versions
- <= 29.0: Affected
No fix published
wwbn/avideo Packagist
- Affected ranges
- ECOSYSTEM: ≤ 29.0
No fix published