WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., `view/about.php`), and it *can* escalate to RCE if an attacker can place or control a PHP file elsewhere in the tree. As of time of publication, no patched versions are available.

Affected: Packagist: wwbn/avideo

### Summary An unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., `view/about.php`), and it *can* escalate to RCE if an attacker can place or control a PHP file elsewhere in the tree. ### Details - Entry point: `plugin/API/get.json.php` sets `$global['bypassSameDomainCheck']=1` and merges GET/POST/JSON into `$parameters` without authentication or API secret. - Handler: `plugin/API/API.php`, method `get_api_locale()` (lines ~5009–5023): ```php $parameters['language'] = strtolower($parameters['language']); $file = "{$global['systemRootPath']}locale/{$parameters['language']}.php"; if (!file_exists($file)) { return new ApiObject("This language does not exists"); } include $file; ``` No validation is performed; `../` traversal is accepted. - Because `include` executes PHP, any reachable PHP file is executed in the web server context.

### PoC 1. Fetch an arbitrary PHP file (no auth): ``` GET /plugin/API/get.json.php?APIName=locale&language=../view/about HTTP/1.1 Host: <target> ``` Response returns the rendered About page HTML, proving traversal outside `locale/`. 2. RCE with an attacker PHP file (any writable PHP path): ``` GET /plugin/API/get.json.php?APIName=locale&language=..…