Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint (`view/hls.php`) is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The `videoDirectory` GET parameter is used in two divergent code paths — one for authorization (which truncates at the first `/` segment) and one for file access (which preserves `..` traversal sequences) — creating a split-oracle condition where authorization is checked against one video while content is served from another. Version 26.0 contains a fix for the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-22 | 2 | Disclosure2 |
| 2026-03-23 | 1 | Disclosure1 |
CVE-2026-33292 Path Traversal in WWBN AVideo HLS Streaming Endpoint Prior to Version 26.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33292
Post summary
The text announces a path‑traversal vulnerability (CVE‑2026‑33292) affecting WWBN AVideo HLS streaming endpoints prior to version 26.0, with no evidence of PoC, exploit tools, or mitigation details.
CVE-2026-33292 WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint (`view/hls.php`) is vulnerable to a path traversal attack that allows … https://www.cve.org/CVERecord?id=CVE-2026-33292
Post summary
CVE-2026-33292 reveals a path traversal flaw in WWBN AVideo's HLS endpoint (<version>26.0). Acknowledgement of the issue without links to exploits, patches or active attacks.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33292 - AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos Intel Report: https://ift.tt/gk6o3N0
Post summary
CVE-2026-33292 is disclosed as an Authorization Bypass via Path Traversal in an HLS endpoint, enabling streaming of private or paid videos, with an Intel report referenced.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wwbn | avideo | - | - | - |