WWBN AVideo is affected by an improper input validation vulnerability (CWE-20) in versions before 29.0. The official Docker compose setup mounts the project root directory as the Apache document root, exposing the .env file publicly because no Apache or .htaccess rules prevent access to dotfiles. The .env file contains critical secrets such as database credentials and admin passwords. Exploiting this vulnerability allows unauthenticated attackers to access these secrets, potentially leading to direct database access, administrative control over the platform, and lateral movement within the Docker network. The vulnerability is fixed in version 29.0.

Exposure of the .env file allows attackers to obtain sensitive information including database credentials and admin passwords. This can lead to unauthorized database access, compromise of the admin panel, and further lateral movement within the Docker network. The CVSS score of 7.5 reflects a high severity with network attack vector, no privileges required, and no user interaction needed. Confidentiality is highly impacted, while integrity and availability are not directly affected.

Upgrade to WWBN AVideo version 29.0 or later, where this issue is resolved. The fix involves changing the Docker compose configuration to prevent the .env file from being served publicly. Until upgrading, restrict access to the .env file by modifying the Apache configuration or .htaccess rules to block access to dotfiles. Avoid using the official docker-compose.yml that mounts the entire project root as the document root without restrictions.