Path traversal in AVideo - CVE-2026-33238
Published: April 8, 2026
Vulnerability identifier: #VU125445
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33238
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to path traversal in listFiles.json.php when handling a user-supplied path parameter. A remote user can send a specially crafted POST request to disclose sensitive information.
The issue is limited to enumeration of .mp4 filenames and their full absolute filesystem paths, and no user interaction is required.
Affected software
AVideo
How to mitigate CVE-2026-33238
Install security update from vendor's website.
AVideo - update to 14.3