WWBN AVideo, an open source video platform, contains a path traversal vulnerability (CWE-22) in the aVideoEncoderReceiveImage.json.php endpoint in versions 26.0 and earlier. Authenticated uploaders can manipulate same-origin /videos/... URLs to bypass pathname restrictions and access arbitrary local files on the server. The vulnerability specifically abuses the GIF poster storage path to read sensitive files and republish their contents as GIF media URLs accessible publicly. This can lead to unauthorized disclosure of sensitive system or application files. The CVSS 3.1 base score is 7.6, reflecting high impact on confidentiality and some impact on integrity and availability. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation allows an authenticated user to read arbitrary local files on the server hosting WWBN AVideo, potentially exposing sensitive system files like /etc/passwd or application source code. This results in a high confidentiality impact, with limited integrity and availability impact. The vulnerability could facilitate further attacks if sensitive information is disclosed. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated uploader privileges and monitor for suspicious activity related to GIF media URL generation. Avoid exposing the vulnerable endpoint to untrusted users. Follow vendor updates closely for an official patch or mitigation instructions.