Arbitrary File Read Vulnerability in WWBN AVideo Open Source Video Platform
CVE-2026-45731

6.9MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
29 May 2026

What is CVE-2026-45731?

AVideo, an open-source video platform developed by WWBN, contains a vulnerability where the view/update.php file improperly handles the $_POST['updateFile'] parameter. This misconfiguration allows an authenticated administrator to exploit the system by specifying a relative path under the updatedb/ directory. Consequently, it enables the reading of arbitrary text files that are accessible to the web-server process, posing a significant security risk.

Affected Version(s)

AVideo <= 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-3...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.