CVE-2026-33238 Details

A path traversal vulnerability has been identified in WWBN AVideo versions prior to 26.0. The issue resides in the `listFiles.json.php` endpoint, which accepts a `path` POST parameter and passes it directly to the `glob()` function without proper validation. This flaw allows authenticated uploaders to traverse the server filesystem by providing arbitrary absolute paths. The vulnerability enables enumeration of `.mp4` files and their full filesystem paths, including locations outside the web root, such as private or premium media directories.

Users are advised to update to AVideo version 26.0 or later, where this vulnerability has been patched. For those using version 14.0 or earlier, the recommended fix is to modify the `listFiles.json.php` endpoint to validate and restrict the `path` parameter before it is used with `glob()`. This can be done by checking that the resolved path starts with an allowed base directory, thereby preventing unauthorized traversal.