PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46337 WWBN CVE debrief

WWBN AVideo 29.0 and earlier contains an unauthenticated arbitrary file read vulnerability. An unauthenticated remote attacker can read arbitrary image files anywhere on disk accessible to the PHP user, including private user-profile photos protected by ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content in sibling application directories reachable via directory traversal. The affected endpoint requires no authentication. The vulnerability is classified as CWE-22 (Path Traversal).

Vendor
WWBN
Product
AVideo
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-21
Advisory published
2026-05-29
Advisory updated
2026-07-21

Who should care

Organizations running WWBN AVideo 29.0 or earlier; security teams responsible for content management platforms; hosting providers with multi-tenant AVideo deployments; privacy officers concerned with unauthorized access to user profile images and private media assets

Technical summary

The vulnerability exists in an image-serving endpoint that fails to properly validate and sanitize user-supplied file paths. The endpoint accepts path parameters that can traverse outside intended directories using '..' sequences, allowing access to any image file readable by the PHP process. This bypasses application-level ACLs that normally gate access to sensitive images such as private user profile photos, administrative thumbnails, and poster frames for encrypted video content. The vulnerability also exposes image assets from other applications co-located on the same server if they reside in directories reachable via traversal from the AVideo web root.

Defensive priority

high

Recommended defensive actions

  • Upgrade WWBN AVideo to a version newer than 29.0 once a patched release is available from the vendor
  • Review and restrict filesystem permissions for the PHP user to limit accessible directories
  • Implement network-level access controls to restrict exposure of AVideo instances to untrusted networks
  • Monitor access logs for anomalous requests to image-serving endpoints that may indicate traversal attempts
  • Validate that image-serving endpoints enforce proper path normalization and access control checks

Evidence notes

Vulnerability confirmed via GitHub Security Advisory GHSA-w4qq-74h6-58wq. CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, with low confidentiality impact. NVD status is 'Undergoing Analysis' as of disclosure date.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46337 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46337

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46337 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46337

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.