BigBlueButton up to 3.0.21 /var/bigbluebutton exposure of resource

Summaryinfo

A vulnerability classified as critical has been found in BigBlueButton up to 3.0.21. This affects an unknown part of the file /var/bigbluebutton. Performing a manipulation results in exposure of resource. This vulnerability was named CVE-2026-27466. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in BigBlueButton up to 3.0.21. This affects some unknown processing of the file /var/bigbluebutton. The manipulation with an unknown input leads to a exposure of resource vulnerability. CWE is classifying the issue as CWE-668. The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. This is going to have an impact on confidentiality, and availability. The summary by CVE is:

BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for "Server Customization" on Support for ClamAV as presentation file scanner contains instructions that leave a BBB server vulnerable for Denial of Service. The flawed command exposes both ports (3310 and 7357) to the internet. A remote attacker can use this to send complex or large documents to clamd and waste server resources, or shutdown the clamd process. The clamd documentation explicitly warns about exposing this port. Enabling ufw (ubuntu firewall) during install does not help, because Docker routes container traffic through the nat table, which is not managed or restricted by ufw. Rules installed by ufw in the filter table have no effect on docker traffic. In addition, the provided example also mounts /var/bigbluebutton with write permissions into the container, which should not be required. Future vulnerabilities in clamd may allow attackers to manipulate files in that folder. Users are unaffected unless they have opted in to follow the extra instructions from BigBlueButton's documentation. This issue has been fixed in version 3.0.22.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-27466 since 02/19/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.0.22 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0463). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Open Source BigBlueButton

Productinfo

Name

• BigBlueButton

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18
• 3.0.19
• 3.0.20
• 3.0.21

License

• free

Website

• Product: https://github.com/bigbluebutton/bigbluebutton/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion