{"id":"CVE-2026-45731","aliases":["EUVD-2026-33306","GHSA-3mjv-375j-6h92"],"status":"published","title":"WWBN AVideo: Authenticated Arbitrary File Read in view/update.php","description":"WWBN AVideo is an open source video platform. In 29.0 and earlier, view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00469,"percentile":0.41064,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-05-18T19:01:59Z","modified":"2026-10-28T02:30:37Z","affected":[{"source":"ghsa","ecosystem":"Packagist","package":"WWBN/AVideo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"29.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"WWBN/AVideo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"29.0"}]}]}],"products":[{"vendor":"wwbn","product":"avideo"}],"references":[{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-3mjv-375j-6h92","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45731","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3mjv-375j-6h92"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45731.json","tags":["advisory"]},{"url":"https://github.com/WWBN/AVideo","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-45731","title":"WWBN AVideo: Authenticated Arbitrary File Read in view/update.php","description":"WWBN AVideo is an open source video platform. In 29.0 and earlier, view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.","status":"published","published":"2026-05-29T13:05:02.855Z","modified":"2026-05-29T14:03:09.98Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-33306","description":"WWBN AVideo is an open source video platform. In 29.0 and earlier, view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.","status":"published","published":"2026-05-29T13:05:02Z","modified":"2026-05-29T14:03:09Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:21:01.215325Z"}],"ghsa":[{"id":"GHSA-3mjv-375j-6h92","title":"AVideo: Authenticated Arbitrary File Read in view/update.php","description":"### Summary\nview/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process — especially valuable on misconfigured deployments where /etc/passwd, .env, or other sibling-app configs are reachable relative to the AVideo directory.\n\n### Details\nview/update.php, lines 134-145 (excerpt):\n\nif (!empty($_POST['updateFile'])) {\n    $dir = Video::getStoragePath() . \"cache\";\n    rrmdir($dir);\n    /* …unrelated cache-clear… */\n\n    if (file_exists($logfile . \"log\")) {\n        unlink($logfile . \"log\");\n        // ...\n    }\n    $lines = file(\"{$global['systemRootPath']}updatedb/{$_POST['updateFile']}\");\nThe User::isAdmin() and adminSecurityCheck(true) guards at lines 12-15 enforce admin auth, but $_POST['updateFile'] is concatenated into a path without any sanitization. file() returns the file's contents as an array of lines; the script subsequently iterates them and echoes the SQL it would run.\n\n### PoC\nPOST /view/update.php\nContent-Type: application/x-www-form-urlencoded\n\nupdateFile=../../../../etc/passwd\nResult: the script attempts to load /etc/passwd (relative to {systemRootPath}updatedb/), echoing each line in the migration-runner HTML output. $_POST['updateFile'] traversal accepted, no extension guard, no in-array whitelist.\n\nAttempting ../../../../proc/self/environ similarly reveals web-server environment variables on Linux.\n\n\n\n### Impact\nVerified on the current master branch of WWBN/AVideo (commit bc0340662…). Likely affected: every release where view/update.php contains the $_POST['updateFile'] consumer — pattern predates 2024.","status":"published","published":"2026-05-18T19:01:59Z","modified":"2026-06-09T10:28:39Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:40:22.540562Z"}],"nvd":[{"id":"CVE-2026-45731","description":"WWBN AVideo is an open source video platform. In 29.0 and earlier, view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.","status":"published","published":"2026-05-29T14:16:31.383Z","modified":"2026-07-21T12:10:00.09Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:21.244426Z"}],"osv":[{"id":"CVE-2026-45731","title":"WWBN AVideo: Authenticated Arbitrary File Read in view/update.php","description":"WWBN AVideo is an open source video platform. In 29.0 and earlier, view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.","status":"published","published":"2026-05-29T13:05:02.855Z","modified":"2026-10-28T02:30:37.104918503Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:05.525666Z"},{"id":"GHSA-3mjv-375j-6h92","title":"AVideo: Authenticated Arbitrary File Read in view/update.php","description":"### Summary\nview/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process — especially valuable on misconfigured deployments where /etc/passwd, .env, or other sibling-app configs are reachable relative to the AVideo directory.\n\n### Details\nview/update.php, lines 134-145 (excerpt):\n\nif (!empty($_POST['updateFile'])) {\n    $dir = Video::getStoragePath() . \"cache\";\n    rrmdir($dir);\n    /* …unrelated cache-clear… */\n\n    if (file_exists($logfile . \"log\")) {\n        unlink($logfile . \"log\");\n        // ...\n    }\n    $lines = file(\"{$global['systemRootPath']}updatedb/{$_POST['updateFile']}\");\nThe User::isAdmin() and adminSecurityCheck(true) guards at lines 12-15 enforce admin auth, but $_POST['updateFile'] is concatenated into a path without any sanitization. file() returns the file's contents as an array of lines; the script subsequently iterates them and echoes the SQL it would run.\n\n### PoC\nPOST /view/update.php\nContent-Type: application/x-www-form-urlencoded\n\nupdateFile=../../../../etc/passwd\nResult: the script attempts to load /etc/passwd (relative to {systemRootPath}updatedb/), echoing each line in the migration-runner HTML output. $_POST['updateFile'] traversal accepted, no extension guard, no in-array whitelist.\n\nAttempting ../../../../proc/self/environ similarly reveals web-server environment variables on Linux.\n\n\n\n### Impact\nVerified on the current master branch of WWBN/AVideo (commit bc0340662…). Likely affected: every release where view/update.php contains the $_POST['updateFile'] consumer — pattern predates 2024.","status":"published","published":"2026-05-18T19:01:59Z","modified":"2026-09-10T03:51:04.396226571Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:35.747385Z"}]}}