What is the CVSS score of CVE-2026-41062?

CVE-2026-41062 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

WWBN AVideo CVE-2026-41062

MEDIUM

Path Traversal (CWE-22)

2026-04-21 security-advisories@github.com

PHP Path Traversal Avideo Wwbn

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint requires uploader authentication (PR:L); low complexity bypass yields full file-read confidentiality impact with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 05:25 vuln.today

Analysis Generated

Jul 24, 2026 - 05:25 vuln.today

CVE Published

Apr 21, 2026 - 23:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for objects/aVideoEncoderReceiveImage.json.php only checks the URL path component (via parse_url($url, PHP_URL_PATH)) for .. sequences. However, the downstream function try_get_contents_from_local() in objects/functionsFile.php uses explode('/videos/', $url) on the full URL string including the query string. An attacker can place the /videos/../../ traversal payload in the query string to bypass the security check and read arbitrary files from the server filesystem. Commit bd11c16ec894698e54e2cdae25026c61ad1ed441 contains an updated fix.

AnalysisAI

Path traversal fix bypass in WWBN AVideo 29.0 and below allows authenticated uploaders to read arbitrary files from the server and exfiltrate them through a public GIF media URL. The partial fix in commit 2375eb5e0 validated only the URL path component via PHP's parse_url(), but the downstream try_get_contents_from_local() function in objects/functionsFile.php parses the full URL string - including query parameters - using explode('/videos/', $url), enabling traversal payloads embedded in the query string to bypass the check entirely. A detailed proof-of-concept is publicly available in the GHSA-f4f9-627c-jh33 advisory; no CISA KEV listing exists, and EPSS at 0.20% reflects low automated exploitation probability consistent with the required authentication barrier.

Technical ContextAI

AVideo is a PHP-based open source video platform (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), arising from a split-parsing inconsistency between the security validation layer and the file retrieval layer. The sanitization check in objects/aVideoEncoderReceiveImage.json.php extracts only the path component of the attacker-supplied URL via parse_url($url, PHP_URL_PATH) and checks it for .. sequences. However, try_get_contents_from_local() in objects/functionsFile.php calls explode('/videos/', $url) on the raw full URL string, including any query string. A traversal sequence like /videos/../../etc/passwd placed in the query component is invisible to the path-only validator but is treated as a valid local path segment by the retrieval function. This CVE is specifically a bypass of an earlier incomplete fix (commit 2375eb5e0) for the original str_replace('../','') vulnerability documented in GHSA-f4f9-627c-jh33, which itself was bypassable with overlapping sequences like ....//. The exploited feature is the GIF poster image fetch mechanism, which writes fetched bytes to a public media storage path without effective content validation.

RemediationAI

Apply the updated fix in commit bd11c16ec894698e54e2cdae25026c61ad1ed441, available at https://github.com/WWBN/AVideo/commit/bd11c16ec894698e54e2cdae25026c61ad1ed441. The prior fix in commit 2375eb5e0 is explicitly insufficient and must not be treated as complete remediation. No released tagged version containing the fix is independently confirmed - the GHSA package data states 'fixed in: None,' suggesting the patch exists only as an untagged commit; verify the release status with the vendor via https://github.com/WWBN/AVideo/security/advisories/GHSA-m63r-m9jh-3vc6. As a compensating control pending patch deployment, restrict external access to objects/aVideoEncoderReceiveImage.json.php via web server ACLs or firewall rules - this eliminates the attack surface entirely at the cost of disabling GIF poster auto-fetch functionality. Additionally, enforce strict uploader account registration controls to limit the authenticated population that can exploit this flaw; on open-registration instances, this is particularly critical.