CVE-2026-39369: Wwbn Avideo

High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days.

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storage path. The vulnerable GIF branch could be abused to read local files such as /etc/passwd or application source files and republish those bytes through a normal public GIF media URL.

Affected products

• Wwbn Avideo: up to and including 26.0

Published 2026-04-07. Last modified 2026-07-24.