A critical path traversal vulnerability in WWBN AVideo versions 26.0 and earlier allows unauthenticated attackers to perform arbitrary file disclosure and potential remote code execution.

This vulnerability stems from improper input validation in the API endpoint (APIName=locale), which fails to sanitize user input before passing it to a PHP include statement. An unauthenticated attacker can leverage this flaw to traverse directories and include arbitrary PHP files located within the web root.

The ability for an unauthenticated user to read sensitive configuration files or execute arbitrary PHP code poses a severe risk to data confidentiality and system integrity. With a CVSS score of 8.6, this vulnerability represents a high-severity threat that could lead to full application compromise, unauthorized data access, and potential lateral movement within the hosting environment.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected API endpoints via network-level controls or disable the AVideo platform until a security update is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous requests containing directory traversal sequences (such as ../) targeting the locale API parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block path traversal attempts and unauthorized include requests targeting the application.

Public Exploit Available: Unknown.

Given the lack of a vendor-provided fix and the high-risk nature of remote code execution, organizations must prioritize the isolation of the affected AVideo instances. Administrators should monitor official project channels for updates and apply the patch as soon as it becomes available to remediate this critical security gap.