CVE-2026-41062Disclosure(wwbn / avideo)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch wwbn avideo systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceiveImage.json.php` only checks the URL path component (via `parse_url($url, PHP_URL_PATH)`) for `..` sequences. However, the downstream function `try_get_contents_from_local()` in `objects/functionsFile.php` uses `explode('/videos/', $url)` on the **full URL string** including the query string. An attacker can place the `/videos/../../` traversal payload in the query string to bypass the security check and read arbitrary files from the server filesystem. Commit bd11c16ec894698e54e2cdae25026c61ad1ed441 contains an updated fix.

wwbn CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

avideo

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked at 2 mentions on most recent observed day (2026-04-25)
3 total mentions across 2 days

Affected systems

Vendors

wwbn

Products

avideo

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-22	1	Disclosure1
2026-04-25	2	Disclosure2

Full discourse3 posts

Infoflowcloud@infoflowcloud168d
Disclosure
🚨*CVE* CVE-2026-41062 WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceive… https://www.cve.org/CVERecord?id=CVE-2026-41062 ----- Traducción: CVE-2026-41062 WWB… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑41062, a directory‑traversal flaw in WWBN AVideo (v29.0 and below), and indicates that commit 2375eb5e0 fixed the issue. No proof‑of‑concept, exploit code, or active exploitation evidence is provided.
0000046
72 followersView on X
CVE@CVEnew168d
Disclosure
CVE-2026-41062 WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceive… https://www.cve.org/CVERecord?id=CVE-2026-41062
Post summary
The note announces CVE‑2026‑41062 in WWBN AVideo, identifies it as a directory traversal flaw addressed by commit 2375eb5e0, with no evidence of active exploitation or PoC.
00000215
57.3K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds172d
Disclosure
CVE-2026-41062 Directory Traversal in WWBN AVideo 29.0 and Below via Query String Bypas... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41062 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The tweet announces CVE-2026-41062 as a directory traversal vulnerability affecting WWBN AVideo 29.0 and earlier, linking to vulnerability details and alerts, but provides no proof of concept, exploit tool, active exploitation evidence, or patch information.
0000036
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	wwbn	avideo	-	-	-

Explore more

Back to dashboard wwbn CVEs avideo vulnerabilities

What researchers are saying

CVE-2026-41062

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE‑2026‑41062, a directory‑traversal flaw in WWBN AVideo (v29.0 and below), and indicates that commit 2375eb5e0 fixed the issue. No proof‑of‑concept, exploit code, or active exploitation evidence is provided.

CVE@CVEnewDisclosure

The note announces CVE‑2026‑41062 in WWBN AVideo, identifies it as a directory traversal flaw addressed by commit 2375eb5e0, with no evidence of active exploitation or PoC.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The tweet announces CVE-2026-41062 as a directory traversal vulnerability affecting WWBN AVideo 29.0 and earlier, linking to vulnerability details and alerts, but provides no proof of concept, exploit tool, active exploitation evidence, or patch information.