WWBN AVideo is an open source video platform. Versions before 29.0 improperly expose the .env file through the official Docker compose setup because the docker-compose.yml mounts the entire project root as the Apache document root. This configuration serves the .env file as a static file at the web root without any .htaccess or Apache rules to block access to dotfiles. The .env file contains sensitive data including database credentials, admin passwords, and infrastructure configuration. Exploiting this vulnerability can lead to direct database access, admin panel takeover, and lateral movement within the Docker network. The vulnerability is fixed in version 29.0.

Exposure of the .env file allows unauthenticated attackers to obtain sensitive credentials and configuration details. This can lead to unauthorized database access, compromise of the admin panel, and further lateral movement within the Docker network, potentially resulting in a full system compromise.

Upgrade to WWBN AVideo version 29.0 or later, where this issue is resolved. The fix involves changing the Docker compose configuration to prevent the .env file from being served publicly. Until upgrading, restrict access to the .env file by modifying the Apache configuration or docker-compose setup to block access to dotfiles.