EUVD-2026-322861

fkie_cve-2026-46337

WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via .. traversal. The endpoint requires no authentication.

GHSA-w4qq-74h6-58wq — AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`

Affected: Packagist: WWBN/AVideo

### Summary The endpoint requires **no authentication**. An unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via `..` traversal.

### Details `view/img/image404Raw.php` reads the `image` GET parameter and joins it directly into a filesystem path served via `readfile()`. `view/img/image404Raw.php` (full file, current `master` @ `0dbadbcaaa1b415c7db078a72dc4b26d9fac0485`):

```php <?php

// Fetch requested image URL $imageURL = !empty($_GET['image']) ? $_GET['image'] : $_SERVER["REQUEST_URI"]; $rootDir = dirname(__FILE__) . '/../../'; if ($imageURL == 'favicon.ico') { $imgLocalFile = "{$rootDir}/videos/{$imageURL}"; } else { $imgLocalFile = "{$rootDir}/{$imageURL}"; // ← attacker-controlled }

if (file_exists($imgLocalFile)) { $imageInfo = getimagesize($imgLocalFile); // ← format gate if (empty($imageInfo)) { die('not image'); } // …extension → Content-Type mapping… header("HTTP/1.0 200 OK"); header('Content-Type: ' . $type); header('Content-Length: ' . filesize($imgLocalFile)); readfile($imgLocalFile); // ← exfil bytes exit; } ```

Issues:

1. **No authentication.** The file is reachable via direct GET; no `require` of `globals.php`, no session…

Most recent entries from all

EUVD-2026-322861

fkie_cve-2026-46337

GHSA-w4qq-74h6-58wq — AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`