CVE-2026-39369

WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storage path. The vulnerable GIF branch could be abused to read local files such as /etc/passwd or application source files and republish those bytes through a normal public GIF media URL.

Affected

WWBN · AVideo

CVSS v3.1 GITHUB

7.6 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

EPSS

0.51% chance of exploitation in the next 30 days, 42nd percentile

Published

2026-04-07

Updated

2026-05-14

Proof-of-concept exploits (1)

• advisories/GHSA-f4f9-627c-jh33

Security advisories

• WWBN/AVideo/security/advisories/GHSA-f4f9-627c-jh33
• WWBN/AVideo/commit/2375eb5e0a6d3cbcfb05377657d0820a7d470b1d

References

• CVE Record
• NVD entry