CVE-2026-41062: WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters
(updated )
The directory traversal fix introduced in commit 2375eb5e0 for objects/aVideoEncoderReceiveImage.json.php only checks the URL path component (via parse_url($url, PHP_URL_PATH)) for .. sequences. However, the downstream function try_get_contents_from_local() in objects/functionsFile.php uses explode('/videos/', $url) on the full URL string including the query string. An attacker can place the /videos/../../ traversal payload in the query string to bypass the security check and read arbitrary files from the server filesystem.
References
- github.com/WWBN/AVideo/commit/2375eb5e0a6d3cbcfb05377657d0820a7d470b1d
- github.com/WWBN/AVideo/commit/bd11c16ec894698e54e2cdae25026c61ad1ed441
- github.com/WWBN/AVideo/security/advisories/GHSA-f4f9-627c-jh33
- github.com/WWBN/AVideo/security/advisories/GHSA-m63r-m9jh-3vc6
- github.com/advisories/GHSA-m63r-m9jh-3vc6
- nvd.nist.gov/vuln/detail/CVE-2026-41062
Code Behaviors & Features
Detect and mitigate CVE-2026-41062 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →