PT-2026-30988 · Wwbn · Avideo

Threalwinky · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-39369

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 26.0 and prior

Description WWBN AVideo, an open source video platform, has an issue in the aVideoEncoderReceiveImage.json.php file. An authenticated uploader can fetch attacker-controlled URLs, bypassing traversal scrubbing and exposing server-local files through the GIF poster storage path. This allows reading local files, such as /etc/passwd or application source files, and republishing their content through a public GIF media URL.

Recommendations Update to a version of WWBN AVideo later than 26.0.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-39369

GHSA-F4F9-627C-JH33

Affected Products

Avideo

References · 8

• https://github.com/WWBN/AVideo/commit/2375eb5e0a6d3cbcfb05377657d0820a7d470b1d · Patch
• https://osv.dev/vulnerability/GHSA-f4f9-627c-jh33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39369 · Security Note
• https://github.com/WWBN/AVideo/security/advisories/GHSA-f4f9-627c-jh33 · Note
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/infoflowcloud/status/2041714116012687790 · Twitter Post
• https://twitter.com/CVEnew/status/2041711907837792411 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1sft88v/resumen_diario_de_vulnerabilidades_08042026 · Reddit Post