WWBN AVideo versions 29.0 and earlier contain a path traversal vulnerability (CWE-22) in the file objects/aVideoEncoderReceiveImage.json.php. The initial fix only checked the URL path component for '..' sequences, but the downstream function try_get_contents_from_local() uses the full URL string including the query string to extract file paths. This discrepancy allows an attacker to craft a URL with traversal sequences in the query string to bypass the check and read arbitrary files from the server filesystem. A subsequent commit (bd11c16ec894698e54e2cdae25026c61ad1ed441) contains an updated fix addressing this issue.

An attacker with at least low privileges can exploit this vulnerability to read arbitrary files on the server hosting WWBN AVideo, potentially exposing sensitive information. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction needed, unchanged scope, and high confidentiality impact. There is no impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in a later commit (bd11c16ec894698e54e2cdae25026c61ad1ed441), so upgrading to a version including this fix is recommended once available. Until then, restrict access to trusted users and monitor for suspicious file access patterns related to URL query strings containing traversal sequences.