Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly to `glob()` without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by supplying arbitrary absolute paths, enumerating `.mp4` filenames and their full absolute filesystem paths wherever they exist on the server — including locations outside the web root, such as private or premium media directories. Version 26.0 contains a patch for the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33238 WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly to `glob… https://www.cve.org/CVERecord?id=CVE-2026-33238
Post summary
The post announces CVE-2026‑33238, detailing how an unsanitized path parameter is accepted, but provides no exploit, patch, or evidence of active use.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33238 - AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration Intel Report: https://ift.tt/JPSVUQK
Post summary
An alert announcing CVE-2026-33238, a path‑traversal flaw in AVideo’s listFiles.json.php that allows server filesystem enumeration, with a link to additional intel.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wwbn | avideo | - | - | - |