File And Directory Information Exposure in AVideo - CVE-2026-33692
Published: November 11, 2026
Vulnerability identifier: #VU165924
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33692
CWE-ID: CWE-538
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose database credentials, administrator passwords, and internal infrastructure configuration.
The vulnerability exists due to placement of sensitive files in an externally accessible directory in AVideo's official Docker Compose configuration when mounting the entire project directory as the Apache document root without restricting dotfile access. A remote attacker can send GET /.env to retrieve the exposed configuration file and its secrets.
Affected software
AVideo
How to mitigate CVE-2026-33692
Install security update from vendor's website.
AVideo - update to 27.0