WWBN AVideo versions up to 29.0 contain an improper limitation of a pathname to a restricted directory (CWE-22) vulnerability. An unauthenticated attacker can exploit this path traversal flaw to access arbitrary image files on the server that the PHP process can read. This includes sensitive images normally protected by access controls within the application. The vulnerability arises because the endpoint handling image requests does not properly restrict directory traversal sequences (e.g., '..'), allowing access beyond intended directories. No authentication is required to exploit this issue.

An attacker can read arbitrary image files anywhere on disk accessible by the PHP user, including private user-profile photos and other sensitive image content that should be protected by access controls. This leads to unauthorized disclosure of potentially sensitive or private information. There is no indication of code execution or modification, so the impact is limited to information disclosure of image files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated and no temporary workaround is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the vulnerable endpoint via network controls or web application firewall rules may help mitigate exposure.