Vulnerability Description
WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via .. traversal. The endpoint requires no authentication.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wwbn | Avideo | <= 29.0 |
Related Weaknesses (CWE)
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-w4qq-74h6-58wqExploitMitigationVendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-w4qq-74h6-58wqExploitMitigationVendor Advisory
FAQ
What is CVE-2026-46337?
CVE-2026-46337 is a vulnerability with a CVSS score of 5.3 (MEDIUM). WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private use...
How severe is CVE-2026-46337?
CVE-2026-46337 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-46337?
Check the references section above for vendor advisories and patch information. Affected products include: Wwbn Avideo.