What is the CVSS score of EUVD-2026-19883?

EUVD-2026-19883 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-19883?

CVE-2026-39369 is a path traversal vulnerability in WWBN AVideo platform version 26.0 and earlier that enables authenticated users with upload privileges to read sensitive server files including…

How to fix or mitigate EUVD-2026-19883?

Within 24 hours: Identify all WWBN AVideo instances running version 26.0 or earlier and document active uploader accounts. Within 7 days: Disable or revoke upload privileges for non-essential user accounts; implement file access logging on the aVideoEncoderReceiveImage.json.php endpoint; review recent GIF poster uploads for anomalies. Within 30 days: Monitor vendor advisories for patch availability; evaluate migration to patched versions when released; conduct forensic review of upload logs for evidence of exploitation.

PHP EUVD-2026-19883

| CVE-2026-39369 HIGH

Path Traversal (CWE-22)

2026-04-07 GitHub_M

GHSA-f4f9-627c-jh33

PHP Path Traversal

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 23:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 20:16 euvd

EUVD-2026-19883

Analysis Generated

Apr 07, 2026 - 20:16 vuln.today

CVE Published

Apr 07, 2026 - 19:24 nvd

HIGH 7.6

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storage path. The vulnerable GIF branch could be abused to read local files such as /etc/passwd or application source files and republish those bytes through a normal public GIF media URL.

AnalysisAI

Path traversal in WWBN AVideo platform ≤26.0 allows authenticated uploaders to read arbitrary server files via GIF poster manipulation. An attacker with uploader privileges can exploit aVideoEncoderReceiveImage.json.php to bypass path sanitization, fetch local files like /etc/passwd or application source code, and republish the contents through publicly accessible GIF media URLs. CVSS 7.6 reflects high confidentiality impact with low-complexity network attack requiring only low-privilege authentication. No public exploit identified at time of analysis, though EPSS data not available for risk quantification.

Technical ContextAI

This vulnerability exploits a path traversal weakness (CWE-22) in WWBN AVideo's GIF poster generation workflow, specifically within the objects/aVideoEncoderReceiveImage.json.php endpoint. The affected PHP code accepts user-controlled same-origin URLs pointing to /videos/... resources but fails to properly sanitize directory traversal sequences. By manipulating URL parameters with traversal patterns like ../../, an authenticated attacker can break out of the intended directory scope and read arbitrary files from the server filesystem. The vulnerable code path then processes these files through the GIF storage mechanism, effectively converting sensitive file contents into publicly accessible GIF media that can be retrieved through normal application URLs. The cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* identifier confirms this affects the core AVideo application platform. As an open-source video hosting solution built in PHP, AVideo's architecture processes user-uploaded media through various encoding pipelines, and this particular endpoint was intended for legitimate image-to-GIF conversion but lacks sufficient input validation on file paths.

RemediationAI

Organizations running WWBN AVideo must upgrade to a patched version beyond 26.0 that addresses the path traversal vulnerability in aVideoEncoderReceiveImage.json.php. Consult the official GitHub Security Advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-f4f9-627c-jh33 for the specific fixed release version and upgrade instructions. Upstream fix available (PR/commit); released patched version not independently confirmed from available data. As an interim workaround while preparing upgrades, restrict uploader role assignments to only trusted administrators, implement Web Application Firewall rules to block requests containing directory traversal sequences in URLs submitted to the affected endpoint, and monitor access logs for suspicious patterns targeting objects/aVideoEncoderReceiveImage.json.php with unusual /videos/ path parameters. Review existing GIF poster files generated since initial deployment for anomalous content that may indicate prior exploitation and exfiltration of sensitive files. Apply principle of least privilege by ensuring the web server process runs with minimal filesystem read permissions to limit exposure scope if exploitation occurs pre-patch.