WWBN AVideo before version 26.0 contains a CWE-22 path traversal vulnerability in the listFiles.json.php endpoint. The endpoint takes a user-supplied path parameter and uses it in a glob() call without validating or restricting the path to an allowed directory. This allows an authenticated uploader to supply arbitrary absolute paths, enabling traversal of the server filesystem and enumeration of .mp4 files and their full paths outside the intended directory scope. The vulnerability is addressed in version 26.0 by restricting path input to prevent traversal.

An authenticated uploader can enumerate .mp4 files anywhere on the server filesystem, including sensitive directories outside the web root such as private or premium media folders. This exposure of file names and absolute paths could aid an attacker in further attacks or unauthorized access to media content. The vulnerability does not allow modification or deletion of files, nor does it impact availability. The CVSS v3.1 base score is 4.3 (medium severity), reflecting limited confidentiality impact and low complexity of exploitation with required privileges.

Upgrade WWBN AVideo to version 26.0 or later, which contains an official patch restricting the path parameter to an allowed base directory, preventing path traversal. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the vendor's versioning information.