VYPR
← All advisories
Medium severity5.3GHSA Advisory· Published May 29, 2026· Updated Jun 1, 2026

CVE-2026-46337

CVE-2026-46337

Description

WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via .. traversal. The endpoint requires no authentication.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
WWBN/AVideoPackagist
<= 29.0—

Affected products

2
  • WWBN/AvideoGHSA2 versions
    <= 29.0+ 1 more
    • (no CPE)range: <= 29.0
    • cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*range: <=29.0

Patches

Vulnerability mechanics

References

3

News mentions

1