CVE-2026-45731: AVideo: Authenticated Arbitrary File Read in view/update.php

May 18, 2026 (updated June 9, 2026)

view/update.php reads $_POST[‘updateFile’] as a relative path under updatedb/ and passes it to PHP’s file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process — especially valuable on misconfigured deployments where /etc/passwd, .env, or other sibling-app configs are reachable relative to the AVideo directory.

References

github.com/WWBN/AVideo/security/advisories/GHSA-3mjv-375j-6h92
github.com/advisories/GHSA-3mjv-375j-6h92
nvd.nist.gov/vuln/detail/CVE-2026-45731

Code Behaviors & Features

Detect and mitigate CVE-2026-45731 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →