CVE-2026-33692: AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration

June 22, 2026

Attacker: Unauthenticated (any remote user)
Victim: AVideo server and database
Specific damage: Attacker obtains database credentials (DB_MYSQL_USER, DB_MYSQL_PASSWORD), admin password (SYSTEM_ADMIN_PASSWORD), and internal network topology (NETWORK_SUBNET). This enables direct database access, admin panel takeover, and further lateral movement within the Docker network.

References

github.com/WWBN/AVideo/commit/7f418de1a95ab87bb8c8c3eb3702d71c351e098d
github.com/WWBN/AVideo/security/advisories/GHSA-wf69-r4mx-43rr
github.com/advisories/GHSA-wf69-r4mx-43rr
nvd.nist.gov/vuln/detail/CVE-2026-33692

Code Behaviors & Features

Detect and mitigate CVE-2026-33692 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →