SB2026050469 - Path traversal in AVideo

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026050469

SB2026050469 - Path traversal in AVideo

Published: May 4, 2026

Security Bulletin ID SB2026050469
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Path traversal (CVE-ID: CVE-2026-33292)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in the HLS streaming endpoint view/hls.php when handling the videoDirectory GET parameter. A remote attacker can send a specially crafted request to disclose sensitive information.

Exploitation relies on inconsistent handling of the videoDirectory parameter between authorization lookup and filesystem path construction, allowing private, unlisted, or paid videos to be streamed by knowing or guessing a video filename and using a publicly accessible video as the authorization target.


Remediation

Install update from vendor's website.

References