https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 23:13:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-308729 EUVD-2026-308729 https://cve.radiocsirt.org/vuln/euvd-2026-308729 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33238 <p>WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly to `glob()` without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by supplying arbitrary absolute paths, enumerating `.mp4` filenames and their full absolute filesystem paths wherever they exist on the server — including locations outside the web root, such as private or premium media directories. Version 26.0 contains a patch for the issue.</p> <p>WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly to `glob()` without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by supplying arbitrary absolute paths, enumerating `.mp4` filenames and their full absolute filesystem paths wherever they exist on the server — including locations outside the web root, such as private or premium media directories. Version 26.0 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33238 https://cve.radiocsirt.org/vuln/ghsa-4wmm-6qxj-fpj4 <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly to `glob()` without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by supplying arbitrary absolute paths, enumerating `.mp4` filenames and their full absolute filesystem paths wherever they exist on the server — including locations outside the web root, such as private or premium media directories.</p> <p>## Details</p> <p>The vulnerable code is at `objects/listFiles.json.php:8-45`:</p> <p>```php if (!User::canUpload() || !empty($advancedCustom-&gt;doNotShowImportMP4Button)) { return false; } $global[&#39;allowed&#39;] = [&#39;mp4&#39;]; // ... if (!empty($_POST[&#39;path&#39;])) { $path = $_POST[&#39;path&#39;]; if (substr($path, -1) !== &#39;/&#39;) { $path .= &#34;/&#34;; } if (file_exists($path)) { $extn = implode(&#34;,*.&#34;, $global[&#39;allowed&#39;]); $filesStr = &#34;{*.&#34; . $extn . &#34;,*.&#34; . strtolower($extn) . &#34;,*.&#34; . strtoupper($extn) . &#34;}&#34;; $video_array = glob($path . $filesStr, GLOB_BRACE); foreach ($video_array as $key =&gt; $value) { $filePath = mb_convert_encoding($value, &#39;UTF-8&#39;); // ... $obj-&gt;path = $filePath; // Full absolute path returned to caller ```</p> <p>The `$_POST[&#39;path&#39;]` value is used directly in `glob()` with no call to `realpath()` for normalization and no prefix check against a permitted base directory (e.g., `$global[&#39;systemRootPath&#39;] . &#39;videos/&#39;`). The response includes `o…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly to `glob()` without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by supplying arbitrary absolute paths, enumerating `.mp4` filenames and their full absolute filesystem paths wherever they exist on the server — including locations outside the web root, such as private or premium media directories.</p> <p>## Details</p> <p>The vulnerable code is at `objects/listFiles.json.php:8-45`:</p> <p>```php if (!User::canUpload() || !empty($advancedCustom-&gt;doNotShowImportMP4Button)) { return false; } $global[&#39;allowed&#39;] = [&#39;mp4&#39;]; // ... if (!empty($_POST[&#39;path&#39;])) { $path = $_POST[&#39;path&#39;]; if (substr($path, -1) !== &#39;/&#39;) { $path .= &#34;/&#34;; } if (file_exists($path)) { $extn = implode(&#34;,*.&#34;, $global[&#39;allowed&#39;]); $filesStr = &#34;{*.&#34; . $extn . &#34;,*.&#34; . strtolower($extn) . &#34;,*.&#34; . strtoupper($extn) . &#34;}&#34;; $video_array = glob($path . $filesStr, GLOB_BRACE); foreach ($video_array as $key =&gt; $value) { $filePath = mb_convert_encoding($value, &#39;UTF-8&#39;); // ... $obj-&gt;path = $filePath; // Full absolute path returned to caller ```</p> <p>The `$_POST[&#39;path&#39;]` value is used directly in `glob()` with no call to `realpath()` for normalization and no prefix check against a permitted base directory (e.g., `$global[&#39;systemRootPath&#39;] . &#39;videos/&#39;`). The response includes `o…</p> https://cve.radiocsirt.org/vuln/ghsa-4wmm-6qxj-fpj4