Avideo EUVD-2026-19883

WWBN AVideo versions 26.0 and prior. Attacker must be an authenticated uploader. Exploitation occurs through objects/aVideoEncoderReceiveImage.json.php by supplying crafted same-origin /videos/... URLs to bypass traversal scrubbing and expose server-local files via GIF poster storage.

Real-world risk is moderate-high despite the 7.6 CVSS score. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low complexity, but critically requires authenticated attacker credentials with uploader privileges, limiting the attack surface to compromised or malicious user accounts. The high confidentiality impact (C:H) is accurate as attackers can exfiltrate sensitive files including credentials, configuration data, or source code containing hardcoded secrets. Low integrity and availability impacts (I:L/A:L) suggest limited system modification beyond file exposure. Without EPSS data, probabilistic exploitation assessment is unavailable, but the requirement for authenticated uploader access significantly reduces automated exploitation potential. No CISA KEV listing indicates no confirmed active exploitation campaigns. The vulnerability's public disclosure via GitHub Security Advisory (GHSA-f4f9-627c-jh33) provides proof-of-concept details to potential attackers, elevating risk for unpatched installations. Organizations using AVideo should prioritize remediation if the platform is internet-facing with untrusted authenticated users, but internal-only deployments with vetted uploaders face reduced immediate risk. The combination of straightforward exploitation (AC:L) and high confidential data exposure makes this a legitimate concern despite authentication barriers.

An attacker with compromised or malicious uploader credentials authenticates to a WWBN AVideo instance and submits a crafted request to objects/aVideoEncoderReceiveImage.json.php containing a same-origin URL like /videos/../../../../../../etc/passwd with traversal sequences bypassing path sanitization. The vulnerable PHP code processes this malicious URL, reads the /etc/passwd file from the server filesystem, and stores the raw file contents into the GIF poster storage path. The attacker then retrieves the publicly accessible GIF media URL generated by the platform, downloads the file containing /etc/passwd data, and extracts usernames and system configuration details. In subsequent requests, the attacker targets application configuration files or source code containing database credentials or API keys, systematically exfiltrating sensitive data through the GIF republishing mechanism without triggering traditional file download monitoring.