CVE-2026-89250 in AVideo
Summary
by MITRE • 09/11/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to download recorded live video files without authentication or authorization checks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in WWBN AVideo, specifically within the codebase associated with commit c3edcc274c389816d434acadac07ee78eaf330c1, represents a critical unauthenticated file read flaw located in the getRecordedFile.php endpoint. This component is responsible for streaming recorded FLV files from the server's temporary directory to clients requesting live video content. The core technical failure lies in the insufficient validation of user-supplied input prior to accessing local filesystem resources. Specifically, the application fails to enforce strict access controls or perform adequate path traversal sanitization when processing requests directed at this endpoint. Consequently, an attacker who possesses knowledge of a valid stream key can manipulate the request parameters to target arbitrary files stored within the temporary directory structure. This lack of authorization checks allows for the direct retrieval of sensitive data without requiring any form of authentication credentials from the requesting party.
From an operational perspective, this vulnerability enables unauthorized access to recorded live video streams that are temporarily stored on the server before being processed or archived. The impact extends beyond simple data exfiltration; it compromises the confidentiality and integrity of user-generated content and potentially sensitive metadata embedded within these files. Attackers can systematically enumerate stream keys or exploit known patterns to download recordings intended for private or restricted audiences. This capability undermines the trust model of the video hosting platform, as users expect their recorded sessions to remain secure until explicitly published or shared by authorized administrators. The ability to access raw FLV files may also facilitate further attacks if these files contain embedded scripts or malicious payloads that could be analyzed in a controlled environment for reverse engineering purposes.
This vulnerability aligns with CWE-200, which categorizes information exposure vulnerabilities where an attacker gains unauthorized access to sensitive information. Furthermore, it maps directly to the ATT&CK technique T1530, Data from Local System, specifically under the sub-technique of File and Directory Discovery followed by Data Staged or Exfiltration over a non-C2 protocol. The exploitation vector is classified as Network-based with Low Complexity, requiring no prior access but relying on the attacker's ability to guess or obtain stream keys, which are often predictable or discoverable through other means such as public broadcasts or leaked configuration data.
Mitigation strategies must focus on implementing robust input validation and strict authorization checks at the application layer. Developers should ensure that all file path inputs are sanitized against directory traversal sequences and restricted to a predefined whitelist of allowed directories. Additionally, access control mechanisms must be enforced to verify that the requesting user has explicit permission to view or download specific recorded files based on their role and ownership status. Implementing authentication requirements for this endpoint would significantly reduce the attack surface by ensuring only verified users can request file streams. Regular security audits and static code analysis should also be employed to detect similar patterns of insecure direct object references across other endpoints within the AVideo application architecture.