CVE-2026-33238

CVE-2026-33238 · AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly to `glob()` without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by supplying arbitrary absolute paths, enumerating `.mp4` filenames and their full absolute filesystem paths wherever they exist on the server — including locations outside the web root, such as private or premium media directories. Version 26.0 contains a patch for the issue.

CVSS 4.3 · Средний · EPSS 0,4% · Есть исправление

Опубликовано

2026-03-20T23:31:35.134Z

Обновлено

2026-05-06T14:40:15.866Z

Стек: php

Проверьте свой сервер →