AVideo CVE-2026-33692
HIGH
GHSA-wf69-r4mx-43rr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote HTTP GET against default Docker deployment retrieves secrets - AV:N/AC:L/PR:N/UI:N; high confidentiality loss only, no integrity or availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
Vulnerability Details
CWE: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory
The official docker-compose.yml (line 61) mounts the entire project root directory as the Apache document root:
volumes:
- "./:/var/www/html/AVideo"This causes the .env file - which contains database credentials, admin passwords, and infrastructure configuration - to be served as a static file at /.env. No .htaccess rule or Apache configuration blocks access to dotfiles.
Exposed Information
An unauthenticated request to GET /.env returns:
DB_MYSQL_HOST=database
DB_MYSQL_USER=avideo
DB_MYSQL_PASSWORD=avideo
SYSTEM_ADMIN_PASSWORD=admin123
TLS_CERTIFICATE_FILE=/etc/apache2/ssl/localhost.crt
TLS_CERTIFICATE_KEY=/etc/apache2/ssl/localhost.key
NETWORK_SUBNET=172.30.0.0/16Steps to Reproduce
Prerequisites
- AVideo deployed using the official
docker-compose.yml - No modifications to the default configuration
Steps
- Deploy AVideo using
docker compose up -d - Send:
curl http://target/.env - The full
.envfile contents are returned, including database credentials and admin password
Impact
- Attacker: Unauthenticated (any remote user)
- Victim: AVideo server and database
- Specific damage: Attacker obtains database credentials (
DB_MYSQL_USER,DB_MYSQL_PASSWORD), admin password (SYSTEM_ADMIN_PASSWORD), and internal network topology (NETWORK_SUBNET). This enables direct database access, admin panel takeover, and further lateral movement within the Docker network.
Proposed Fix
Add a .htaccess rule to block access to dotfiles:
# Block access to hidden files (.env, .git, etc.)
<FilesMatch "^\.">
Order Allow,Deny
Deny from all
</FilesMatch>Or configure Apache to deny dotfile access in the virtual host configuration.
Articles & Coverage 1
AnalysisAI
Unauthenticated information disclosure in WWBN AVideo (versions prior to 29.0) deployed via the official docker-compose.yml exposes the application's .env file at /.env, leaking database credentials, the SYSTEM_ADMIN_PASSWORD, and internal Docker network topology. The default Apache document root mount lacks any rule blocking dotfile access, so a single curl request to /.env returns plaintext secrets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target AVideo instance was deployed using the project's official docker-compose.yml (which bind-mounts ./ to /var/www/html/AVideo) with default Apache configuration and an unmodified pre-29.0 .htaccess, and that the Apache HTTP(S) port is reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) accurately reflects trivial unauthenticated remote retrieval of confidential data with no integrity or availability impact, and the description fully supports it: a single GET /.env returns secrets. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An opportunistic scanner probes internet-exposed AVideo instances with GET /.env and immediately receives plaintext database credentials, the system admin password (default admin123 in the example deployment), and the internal Docker subnet. The attacker logs into the AVideo admin panel with the recovered SYSTEM_ADMIN_PASSWORD and, if the database port is reachable, connects directly to MySQL using DB_MYSQL_USER / DB_MYSQL_PASSWORD to exfiltrate or modify user data. … |
| Remediation | Vendor-released patch: upgrade to AVideo 29.0 or later, which adds a RewriteRule in .htaccess blocking any path component beginning with a dot (except /.well-known/) per commit 7f418de1a95ab87bb8c8c3eb3702d71c351e098d. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all WWBN AVideo deployments; if version pre-29.0, restrict internet-facing access or implement WAF rules blocking /.env. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated remote code execution in Crawl4AI versions <= 0.8.6 allows attackers to escape the AST-based sandbox in
Arbitrary file read in Budibase self-hosted server (@budibase/server <= 3.39.0) allows an authenticated workspace builde
Path traversal in BBOT's unarchive internal module enables a malicious archive hosted by attacker-controlled infrastruct
Authentication bypass in Crawl4AI Docker API server (versions prior to 0.8.7) allows remote unauthenticated attackers to
Remote code execution in vLLM versions prior to 0.22.1 allows attackers to backdoor production LLM inference deployments
Share
External POC / Exploit Code
Leaving vuln.today