https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T01:36:26.406569+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33238 CVE-2026-33238 — AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration 2026-10-18T01:36:26.422665+00:00

Affected: WWBN AVideo

WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly to `glob()` without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by supplying arbitrary absolute paths, enumerating `.mp4` filenames and their full absolute filesystem paths wherever they exist on the server — including locations outside the web root, such as private or premium media directories. Version 26.0 contains a patch for the issue.