An authenticated path traversal vulnerability in WWBN AVideo allows remote attackers to read sensitive server-local files, posing a significant risk to data confidentiality.

This vulnerability is a path traversal flaw (CWE-22) located in the objects/aVideoEncoderReceiveImage.json.php file. It allows an authenticated user with uploader privileges to bypass traversal scrubbing and expose files such as /etc/passwd by manipulating the GIF poster storage path.

The ability to read arbitrary files from the server filesystem can lead to the unauthorized disclosure of sensitive system information, configuration files, and application source code. This level of access often serves as a precursor to further compromise, such as credential theft or full system takeover. Given the CVSS score of 7.6, this is a high-severity issue that requires immediate attention to protect internal infrastructure.

Immediate Action: As no official patch version is currently listed, administrators should restrict uploader access to trusted users only and implement strict egress filtering to prevent unauthorized data exfiltration.

Proactive Monitoring: Review web server access logs for suspicious requests to the aVideoEncoderReceiveImage.json.php endpoint, specifically looking for directory traversal sequences like ../ in URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts containing directory traversal sequences.

Public Exploit Available: No

Due to the severity of this file disclosure vulnerability and the confirmed existence of a proof-of-concept, users of WWBN AVideo must treat this issue as a priority. While a formal patch is pending, organizations should implement the recommended compensating controls and monitor logs for signs of abuse to mitigate the risk of data theft.