WWBN AVideo, an open source video platform, contains a path traversal vulnerability (CWE-22) in versions up to 29.0. The vulnerability exists in view/update.php where the 'updateFile' POST parameter is read as a relative path under the updatedb/ directory and passed directly to PHP's file() function for processing. An authenticated administrator can abuse this to read arbitrary text files accessible to the web server, potentially exposing sensitive information. The CVSS 4.0 score is 6.9, indicating medium severity. No vendor advisory or patch is currently available.

An authenticated administrator can read arbitrary text files on the server that are accessible to the web server process. This could lead to disclosure of sensitive information stored in files outside the intended directory. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the administrator role. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to the update functionality. Avoid exposing the update interface to untrusted networks if possible.