PT-2026-34207 · Wwbn · Avideo

Published 2026-04-14 · Updated 2026-04-25 · CVE-2026-41062

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier

Description A directory traversal flaw exists where a security check in 'objects/aVideoEncoderReceiveImage.json.php' only validates the URL path component for traversal sequences. However, the try get contents from local() function in 'objects/functionsFile.php' processes the full URL string, including the query string, using explode('/videos/', $url). This allows an attacker to bypass the check by placing a traversal payload in the query string to read arbitrary files from the server filesystem.

Recommendations Update to a version containing commit bd11c16ec894698e54e2cdae25026c61ad1ed441.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41062

GHSA-M63R-M9JH-3VC6

Affected Products

Avideo

References · 10

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-m63r-m9jh-3vc6 · Exploit
• https://github.com/WWBN/AVideo/commit/2375eb5e0a6d3cbcfb05377657d0820a7d470b1d · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-f4f9-627c-jh33 · Vendor Advisory
• https://github.com/WWBN/AVideo/commit/bd11c16ec894698e54e2cdae25026c61ad1ed441 · Patch
• https://osv.dev/vulnerability/GHSA-m63r-m9jh-3vc6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41062 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/VulmonFeeds/status/2046861153100329357 · Twitter Post
• https://twitter.com/CVEnew/status/2048168411730248026 · Twitter Post
• https://twitter.com/infoflowcloud/status/2048169377392918668 · Twitter Post