WWBN AVideo, an open source video platform, contains a path traversal vulnerability (CWE-22) in versions 29.0 and below. The initial fix for directory traversal in the file `objects/aVideoEncoderReceiveImage.json.php` only checked the URL path component for '..' sequences using `parse_url($url, PHP_URL_PATH)`. However, the downstream function `try_get_contents_from_local()` in `objects/functionsFile.php` uses `explode('/videos/', $url)` on the entire URL string, including the query string. This discrepancy allows an attacker to inject a traversal payload such as `/videos/../../` in the query string to bypass the check and read arbitrary files from the server filesystem. A subsequent commit (bd11c16ec894698e54e2cdae25026c61ad1ed441) contains an updated fix to properly address this issue. No official patch or vendor advisory is provided in the data.

Successful exploitation of this vulnerability allows an attacker with at least low privileges (PR:L) to read arbitrary files on the server hosting WWBN AVideo, potentially exposing sensitive information. The vulnerability does not impact integrity or availability but has high confidentiality impact. The attack complexity is low and does not require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The data indicates an updated fix exists in a later commit (bd11c16ec894698e54e2cdae25026c61ad1ed441), so upgrading to a version including this fix is recommended once available. Until then, restrict access to the affected endpoints and monitor for suspicious activity related to file access attempts.