CVE-2026-33292
AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
HIGH 7.5EPSS 0.6%
WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint (`view/hls.php`) is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The `videoDirectory` GET parameter is used in two divergent code paths — one for authorization (which truncates at the first `/` segment) and one for file access (which preserves `..` traversal sequences) — creating a split-oracle condition where authorization is checked against one video while content is served from another. Version 26.0 contains a fix for the issue.
- Affected
- WWBN · AVideo
- CVSS v3.1 GITHUB
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- 0.59% chance of exploitation in the next 30 days, 47th percentile
- Published
- 2026-03-22
- Updated
- 2026-03-23
Proof-of-concept exploits (1)
Security advisories
- WWBN/AVideo/security/advisories/GHSA-pw4v-x838-w5pg
- WWBN/AVideo/commit/bc034066281085af00e64b0d7b81d8a025a928c4