WWBN AVideo before version 26.0 contains a CWE-22 path traversal vulnerability in the `listFiles.json.php` endpoint. The endpoint accepts a `path` parameter from authenticated uploaders and passes it unchecked to the glob() function, allowing traversal of arbitrary absolute paths on the server filesystem. This enables enumeration of .mp4 files and their full paths outside the intended restricted directory, potentially exposing private or premium media files. The vulnerability is addressed in version 26.0 by restricting the path parameter to an allowed base directory.

An authenticated uploader can enumerate .mp4 files anywhere on the server filesystem, including outside the web root and in sensitive directories such as private or premium media folders. This exposure is limited to information disclosure of file names and paths; there is no indication of code execution or file modification. The CVSS score is 4.3 (medium severity), reflecting limited confidentiality impact without integrity or availability effects.

Upgrade WWBN AVideo to version 26.0 or later, which contains an official patch restricting the `path` parameter to an allowed base directory and prevents path traversal. No other mitigations are indicated or required once the patch is applied.