PT-2026-41994 · Wwbn+1 · Avideo+1
Pr3Ungdt
·
Published
2026-05-19
·
Updated
2026-05-29
·
CVE-2026-46337
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
AVideo versions 29.0 and earlier
Description
An unauthenticated remote attacker can read arbitrary image files from the disk that the PHP user has permission to open. This includes private user-profile photos protected by Access Control Lists (ACLs), admin-uploaded thumbnails, encrypted-video poster frames, and image content in sibling-app directories. The issue is caused by a path traversal flaw where the application fails to filter
.. segments or validate the destination path, allowing access to files outside the intended directory. The vulnerability is located in the endpoint "/view/img/image404Raw.php" via the image parameter, which is passed directly to the readfile() function. The application uses getimagesize() to verify if a file is an image, but this only checks magic bytes (file headers) and does not restrict the file path. Additionally, the use of $ SERVER["REQUEST URI"] as a fallback when the image parameter is empty further increases the attack surface.Recommendations
For versions 29.0 and earlier, implement the following security measures in the "/view/img/image404Raw.php" endpoint:
- Reject any requests containing path-traversal segments such as
.., null bytes (0), or protocol schemes (://). - Use
realpath()to resolve the absolute path and verify that the resulting path is contained within the intended/videos/or/view/img/directories. - Remove the
$ SERVER["REQUEST URI"]fallback and return a 400 Bad Request error if theimageparameter is not provided. - As a temporary mitigation, restrict access to the "/view/img/image404Raw.php" endpoint or disable it until these changes are applied.
Exploit
Fix
Path traversal
Missing Authorization
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Avideo
Wwbn Avideo