Cloudanix VulnDB

GHSA-m63r-m9jh-3vc6

Medium · 6.5

WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters

CVSS

6.5

EPSS

—

Published

Apr 14, 2026

CISA due date

—

The record

The directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceiveImage.json.php` only checks the URL **path component** (via `parse_url($url, PHP_URL_PATH)`) for `..` sequences. However, the downstream function `try_get_contents_from_local()` in `objects/functionsFile.php` uses `explode('/videos/', $url)` on the **full URL string** including the query string. An attacker can place the `/videos/../../` traversal payload in the query string to bypass the security check and read arbitrary files from the server filesystem.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities