WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly to `glob()` without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by supplying arbitrary absolute paths, enumerating `.mp4` filenames and their full absolute filesystem paths wherever they exist on the server — including locations outside the web root, such as private or premium media directories. Version 26.0 contains a patch for the issue.

Affected: Packagist: wwbn/avideo

## Summary

The `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly to `glob()` without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by supplying arbitrary absolute paths, enumerating `.mp4` filenames and their full absolute filesystem paths wherever they exist on the server — including locations outside the web root, such as private or premium media directories.

## Details

The vulnerable code is at `objects/listFiles.json.php:8-45`:

```php if (!User::canUpload() || !empty($advancedCustom->doNotShowImportMP4Button)) { return false; } $global['allowed'] = ['mp4']; // ... if (!empty($_POST['path'])) { $path = $_POST['path']; if (substr($path, -1) !== '/') { $path .= "/"; } if (file_exists($path)) { $extn = implode(",*.", $global['allowed']); $filesStr = "{*." . $extn . ",*." . strtolower($extn) . ",*." . strtoupper($extn) . "}"; $video_array = glob($path . $filesStr, GLOB_BRACE); foreach ($video_array as $key => $value) { $filePath = mb_convert_encoding($value, 'UTF-8'); // ... $obj->path = $filePath; // Full absolute path returned to caller ```

The `$_POST['path']` value is used directly in `glob()` with no call to `realpath()` for normalization and no prefix check against a permitted base directory (e.g., `$global['systemRootPath'] . 'videos/'`). The response includes `o…