Insecure Code Paths in WWBN AVideo Video Platform

CVE-2026-41064

What is CVE-2026-41064?

WWBN AVideo is a widely used open-source video platform that presents a security concern in versions up to and including 29.0. The vulnerability arises from an incomplete fix in the handling of user-supplied URLs. While the incorporation of escapeshellarg for the wget command enhances security, the file_get_contents and curl methods remain unprotected. This oversight allows potentially malicious URLs, as the regex for URL validation /^http/ incorrectly permits strings like httpevil[.]com, which could lead to unauthorized access or exposure of sensitive data. An updated fix addressing these flaws can be found in commit 78bccae74634ead68aa6528d631c9ec4fd7aa536. For more details, refer to the security advisories linked in the references.

References