PT-2025-30679 · Wwbn · Avideo

Claudio Bozzato · CVE-2025-48732 · Published 2025-07-24 · Updated 2025-07-29

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WWBN AVideo version 14.4 WWBN AVideo dev master commit 8a8954ff

Description An incomplete blacklist in the .htaccess sample allows for arbitrary code execution via a specially crafted HTTP request. An attacker can request a .phar file to trigger this issue.

Recommendations Update WWBN AVideo to a version with a complete blacklist in the .htaccess sample. Avoid allowing requests for .phar files.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2025-48732

Affected Products

Avideo

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48732.json · Exploit
• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2025-2213 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-48732 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48732 · Vendor Advisory
• https://twitter.com/cracbot/status/1950149372483948856 · Twitter Post
• https://t.me/cveNotify/130125 · Telegram Post
• https://twitter.com/CVEnew/status/1948407415394980097 · Twitter Post