WWBN AVideo CVE-2026-41062

Exploitation requires an authenticated session with at least uploader-level privileges on the AVideo platform - the vulnerable endpoint objects/aVideoEncoderReceiveImage.json.php is part of the GIF poster image fetch feature available to users who can manage video content. The target instance must be running AVideo 29.0 or below with commit 2375eb5e0 applied but commit bd11c16ec894698e54e2cdae25026c61ad1ed441 not yet applied - instances that have neither fix are instead vulnerable to the original ....// bypass. The attacker must have network access to the POST endpoint. Files readable are limited to those accessible by the PHP web server process account (typically www-data or equivalent), which constrains but does not eliminate sensitive targets such as /etc/passwd, application configuration files, or readable source files. On AVideo deployments with open or self-service user registration, the uploader credential requirement is a low barrier and should not be relied upon as a meaningful control.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) appropriately captures the authentication barrier (PR:L - uploader role required) and the high confidentiality impact with no integrity or availability consequence. The EPSS score of 0.20% at the 42nd percentile indicates low automated exploitation probability, and SSVC corroborates this with 'Automatable: no' - reflecting the multi-step, session-dependent attack chain. SSVC also rates technical impact as 'partial,' consistent with a scoped file-read primitive rather than remote code execution. The publicly available proof-of-concept in the GHSA advisory materially elevates practical risk above what EPSS alone suggests, as the exploit steps are detailed and require only uploader credentials. No CISA KEV listing exists, indicating no confirmed widespread active exploitation at time of analysis. The most significant risk moderator is the uploader authentication requirement: on AVideo instances with open or self-service registration, this barrier is substantially lower and should be treated as near-unauthenticated for threat modeling purposes. For deployments with strictly controlled user registration, real-world exploitability is meaningfully reduced.

A registered uploader authenticates to an AVideo instance, then sends a POST request to /objects/aVideoEncoderReceiveImage.json.php with the downloadURL_gifimage parameter set to a URL embedding /videos/../../etc/passwd in the query string - the parse_url()-based path check sees only a benign path component and allows the request through. The server's try_get_contents_from_local() function splits on /videos/ in the full URL string, resolves the traversal to the target file, and writes its contents to the GIF destination storage path. The attacker then queries the media list endpoint, retrieves the public GIF URL, and downloads the target file's bytes verbatim; the GHSA-f4f9-627c-jh33 advisory confirms this chain with /etc/passwd as a demonstrated target.