What is the CVSS score of CVE-2026-33692?

CVE-2026-33692 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of AVideo are affected by CVE-2026-33692?

WWBN AVideo versions prior to 29.0 deployed via Docker expose critical credentials-including database and administrator passwords-through an unauthenticated file disclosure vulnerability.. A patch is available.

How to fix or mitigate CVE-2026-33692?

24 hours: Identify all WWBN AVideo deployments; if version pre-29.0, restrict internet-facing access or implement WAF rules blocking /.env. 7 days: Upgrade to WWBN AVideo version 29.0 or later. 30 days: Rotate all database and administrative credentials and audit logs for unauthorized access.

AVideo CVE-2026-33692

EUVD-2026-45037 HIGH

Improper Input Validation (CWE-20)

2026-06-22 https://github.com/WWBN/AVideo

GHSA-wf69-r4mx-43rr

Apache Docker Information Disclosure

7.5

CVSS 3.1 · Vendor: https://github.com/WWBN/AVideo

Severity by source

Vendor (https://github.com/WWBN/AVideo) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote HTTP GET against default Docker deployment retrieves secrets - AV:N/AC:L/PR:N/UI:N; high confidentiality loss only, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/WWBN/AVideo).

CVSS VectorVendor: https://github.com/WWBN/AVideo

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 20:16 vuln.today

Analysis Generated

Jun 22, 2026 - 20:16 vuln.today

CVE Published

Jun 22, 2026 - 19:54 github-advisory

HIGH 7.5

DescriptionCVE.org

Vulnerability Details

CWE: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory

The official docker-compose.yml (line 61) mounts the entire project root directory as the Apache document root:

yaml

volumes:
  - "./:/var/www/html/AVideo"

This causes the .env file - which contains database credentials, admin passwords, and infrastructure configuration - to be served as a static file at /.env. No .htaccess rule or Apache configuration blocks access to dotfiles.

Exposed Information

An unauthenticated request to GET /.env returns:

DB_MYSQL_HOST=database
DB_MYSQL_USER=avideo
DB_MYSQL_PASSWORD=avideo
SYSTEM_ADMIN_PASSWORD=admin123
TLS_CERTIFICATE_FILE=/etc/apache2/ssl/localhost.crt
TLS_CERTIFICATE_KEY=/etc/apache2/ssl/localhost.key
NETWORK_SUBNET=172.30.0.0/16

Steps to Reproduce

Prerequisites

AVideo deployed using the official docker-compose.yml
No modifications to the default configuration

Steps

Deploy AVideo using docker compose up -d
Send: curl http://target/.env
The full .env file contents are returned, including database credentials and admin password

Impact

Attacker: Unauthenticated (any remote user)
Victim: AVideo server and database
Specific damage: Attacker obtains database credentials (DB_MYSQL_USER, DB_MYSQL_PASSWORD), admin password (SYSTEM_ADMIN_PASSWORD), and internal network topology (NETWORK_SUBNET). This enables direct database access, admin panel takeover, and further lateral movement within the Docker network.

Proposed Fix

Add a .htaccess rule to block access to dotfiles:

apache

# Block access to hidden files (.env, .git, etc.)
<FilesMatch "^\.">
    Order Allow,Deny
    Deny from all
</FilesMatch>

Or configure Apache to deny dotfile access in the virtual host configuration.

Articles & Coverage 1

News 5 New Docker Vulnerabilities - 1 Critical, 4 High Severity Jun 23, 2026

AnalysisAI

Unauthenticated information disclosure in WWBN AVideo (versions prior to 29.0) deployed via the official docker-compose.yml exposes the application's .env file at /.env, leaking database credentials, the SYSTEM_ADMIN_PASSWORD, and internal Docker network topology. The default Apache document root mount lacks any rule blocking dotfile access, so a single curl request to /.env returns plaintext secrets. No public exploit identified at time of analysis, though reproduction is trivial against any default Docker deployment.

Technical ContextAI

AVideo is an open-source PHP video streaming platform (composer package wwbn/avideo) shipped with an official Docker Compose stack that bind-mounts the project root (./) to /var/www/html/AVideo as the Apache DocumentRoot. The .env file co-located in the project root therefore becomes a static asset served by Apache, and the shipped .htaccess lacked any FilesMatch or RewriteRule directive denying access to hidden files. While the NVD CWE is listed as CWE-20, the GHSA advisory more accurately classifies this as CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory), a classic deployment-configuration exposure pattern compounded by storing production secrets in a web-served directory.

RemediationAI

Vendor-released patch: upgrade to AVideo 29.0 or later, which adds a RewriteRule in .htaccess blocking any path component beginning with a dot (except /.well-known/) per commit 7f418de1a95ab87bb8c8c3eb3702d71c351e098d. Operators who cannot upgrade immediately should manually add the same rule (RewriteRule "(^|/)\.(?!well-known(?:/|$))" - [F,L,NC]) or a FilesMatch "^\." Deny block to their Apache configuration; this safely blocks .env, .git, and other dotfile exposure but will also break ACME http-01 challenges if the well-known exception is omitted. As an additional hardening step, rotate the leaked DB_MYSQL_PASSWORD and SYSTEM_ADMIN_PASSWORD, move the .env outside the document root, and restrict the docker-compose volume mount to only the public web subdirectory rather than the project root. See https://github.com/WWBN/AVideo/security/advisories/GHSA-wf69-r4mx-43rr for the full advisory.