CVE-2026-33692 Details

A vulnerability exists in WWBN AVideo versions prior to 29.0, where the official Docker compose configuration exposes the .env file to unauthenticated users. The Docker compose file mounts the entire project root directory as the Apache document root, which allows the .env file—containing sensitive information such as database credentials, admin passwords, and infrastructure configuration—to be served as a static file. There are no .htaccess rules or Apache configurations to block access to dotfiles, enabling exploitation that could lead to direct database access, admin panel takeover, and lateral movement within the Docker network.

Users can update to AVideo version 29.0 or later, where this vulnerability has been addressed. For those using earlier versions, it is recommended to add a .htaccess file to block access to dotfiles or to configure Apache to deny access to hidden files through the virtual host settings.