Authentication Bypass in WWBN AVideo Allows File Exposure

CVE-2026-39369

What is CVE-2026-39369?

The WWBN AVideo platform, an open-source solution for video management, is vulnerable due to improper handling of requests in the objects/aVideoEncoderReceiveImage.json.php endpoint. This allows an authenticated uploader to exploit the vulnerability and access attacker-controlled URLs within the same origin. As a result, users can bypass the traversal scrubbing mechanism to read sensitive server files, such as /etc/passwd and other application source files, through publicly accessible GIF media URLs.

References