An authenticated local file read vulnerability in WWBN AVideo up to version 26.0 allows attackers to exfiltrate sensitive files from the server, posing a significant risk to data confidentiality.

This vulnerability involves improper neutralization of special elements in a file path (CWE-73) within the POST /objects/aVideoEncoder.json.php endpoint. An authenticated user can supply a crafted chunkFile parameter to copy sensitive local files into a publicly accessible directory for exfiltration.

Successful exploitation of this flaw allows an authenticated attacker to read arbitrary files on the host server, which may include configuration files, credentials, or system data. Given the CVSS score of 7.6, this is a high-severity issue that could lead to full system compromise or facilitate further attacks by exposing sensitive infrastructure information.

Immediate Action: Apply the fix provided in commit 59bbd601a3f65a5b18c1d9e4eb11471c0a59214f. If a formal update package is not yet available, restrict access to the aVideoEncoder.json.php endpoint to trusted administrative accounts only.

Proactive Monitoring: Monitor access logs for unusual POST requests to aVideoEncoder.json.php containing suspicious file paths or attempts to access directories outside of the intended upload structure.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests to aVideoEncoder.json.php where the chunkFile parameter contains directory traversal sequences or references to protected system paths.

Public Exploit Available: No (no confirmed weaponized exploit or public PoC identified).

Organizations utilizing WWBN AVideo should prioritize the application of the provided security patch to prevent unauthorized file access. Given that the vulnerability requires only authentication, it provides an attractive vector for malicious actors to gain sensitive information, necessitating immediate remediation or the implementation of strict access controls on the affected endpoint.