WWBN AVideo up to 29.0 Query String aVideoEncoderReceiveImage.json.php try_get_contents_from_local url path traversal

Summaryinfo

A vulnerability marked as critical has been reported in WWBN AVideo up to 29.0. Affected is the function try_get_contents_from_local of the file objects/aVideoEncoderReceiveImage.json.php of the component Query String Handler. This manipulation of the argument url causes path traversal. This vulnerability is handled as CVE-2026-41062. The attack can be initiated remotely. There is not any exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in WWBN AVideo up to 29.0. It has been declared as critical. Affected by this vulnerability is the function try_get_contents_from_local of the file objects/aVideoEncoderReceiveImage.json.php of the component Query String Handler. The manipulation of the argument url with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. The summary by CVE is:

WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceiveImage.json.php` only checks the URL path component (via `parse_url($url, PHP_URL_PATH)`) for `..` sequences. However, the downstream function `try_get_contents_from_local()` in `objects/functionsFile.php` uses `explode('/videos/', $url)` on the **full URL string** including the query string. An attacker can place the `/videos/../../` traversal payload in the query string to bypass the security check and read arbitrary files from the server filesystem. Commit bd11c16ec894698e54e2cdae25026c61ad1ed441 contains an updated fix.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-41062 since 04/16/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

By approaching the search of inurl:objects/aVideoEncoderReceiveImage.json.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 2375eb5e0a6d3cbcfb05377657d0820a7d470b1d is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 29.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion