WWBN AVideo versions 26.0 and prior contain a path traversal vulnerability (CWE-22) in the objects/aVideoEncoderReceiveImage.json.php endpoint. An authenticated uploader can manipulate same-origin /videos/... URLs to bypass traversal scrubbing mechanisms, enabling access to arbitrary local files through the GIF poster storage path. This flaw allows sensitive server files, including /etc/passwd and application source files, to be read and republished as GIF media URLs accessible publicly. The vulnerability has a CVSS 3.1 base score of 7.6, indicating high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation can lead to unauthorized disclosure of sensitive local files on the server hosting WWBN AVideo. This includes critical system files and application source code, potentially exposing credentials, configuration details, or proprietary information. The vulnerability affects confidentiality (high impact), with limited impact on integrity and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's communications for updates. Until a patch is available, restrict uploader permissions to trusted users only and consider additional access controls to limit exposure. Avoid exposing the vulnerable endpoint to untrusted authenticated users if possible.