EUVD-2026-292618

fkie_cve-2026-41062

WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceiveImage.json.php` only checks the URL path component (via `parse_url($url, PHP_URL_PATH)`) for `..` sequences. However, the downstream function `try_get_contents_from_local()` in `objects/functionsFile.php` uses `explode('/videos/', $url)` on the **full URL string** including the query string. An attacker can place the `/videos/../../` traversal payload in the query string to bypass the security check and read arbitrary files from the server filesystem. Commit bd11c16ec894698e54e2cdae25026c61ad1ed441 contains an updated fix.

GHSA-m63r-m9jh-3vc6 — WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters

Affected: Packagist: wwbn/avideo

## Summary

The directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceiveImage.json.php` only checks the URL **path component** (via `parse_url($url, PHP_URL_PATH)`) for `..` sequences. However, the downstream function `try_get_contents_from_local()` in `objects/functionsFile.php` uses `explode('/videos/', $url)` on the **full URL string** including the query string. An attacker can place the `/videos/../../` traversal payload in the query string to bypass the security check and read arbitrary files from the server filesystem.

## Details

The security fix at commit 2375eb5e0 added a traversal check at `objects/aVideoEncoderReceiveImage.json.php:49`:

```php $decodedPath = urldecode((string)(parse_url($_REQUEST[$value], PHP_URL_PATH) ?? '')); if (strpos($decodedPath, '..') !== false) { unset($_REQUEST[$value]); } ```

This only inspects the **path component** of the URL. For a URL like `http://TARGET/x?a=/videos/../../etc/passwd`, `parse_url()` returns `/x` as the path — no `..` is found.

The URL then passes through `isValidURL()` (`objects/functions.php:4203`) which accepts it because `FILTER_VALIDATE_URL` considers `..` in query strings valid per RFC 3986.

It also passes `isSSRFSafeURL()` (`objects/functions.php:4264`) because the host matches `webSiteRootURL`, causing an early return at line 4294.

The URL reaches `url_get_contents()` (`objects/functions.php:1938`) which calls `try_get_contents_from_local()` (`objects/functionsFile.php…

Most recent entries from all

EUVD-2026-292618

fkie_cve-2026-41062

GHSA-m63r-m9jh-3vc6 — WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters