SB2026111211 - File And Directory Information Exposure in AVideo

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111211

SB2026111211 - File And Directory Information Exposure in AVideo

Published: November 12, 2026

Security Bulletin ID SB2026111211
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) File And Directory Information Exposure (CVE-ID: CVE-2026-33692)

CWE-ID: CWE-538 - File And Directory Information Exposure

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose database credentials, administrator passwords, and internal infrastructure configuration.

The vulnerability exists due to placement of sensitive files in an externally accessible directory in AVideo's official Docker Compose configuration when mounting the entire project directory as the Apache document root without restricting dotfile access. A remote attacker can send GET /.env to retrieve the exposed configuration file and its secrets.


Remediation

Install update from vendor's website.

References