CVE-2026-46337

MediumCVSS 5.3/10Last modified Jul 21, 2026

Description

WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via .. traversal. The endpoint requires no authentication.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: May 29, 2026
Last modified: Jul 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-463384.3PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a stri CVE-2026-4633910.09Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api CVE-2026-46347.5A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an CVE-2026-463407.5Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.1 CVE-2026-463416.1The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on CVE-2026-463425.4Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @CVE-2026-463437.2Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, Wazuh CVE-2026-463445.3liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-CVE-2026-463458.4compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in CVE-2026-463466.5The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password CVE-2026-463476.8The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a passwo CVE-2026-463488.7Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the list of disallowed IP a