AVideo - CraftedSignal Threat Feed

AVideo OS Command Injection Vulnerability (CVE-2026-33482)

hello@craftedsignal.io — Tue, 30 Jan 2024 12:00:00 +0000

AVideo, an open-source video platform, contains an OS command injection vulnerability (CVE-2026-33482) affecting versions up to and including 26.0. The vulnerability resides within the sanitizeFFmpegCommand() function located in plugin/API/standAlone/functions.php. This function is intended to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters. However, it fails to properly sanitize the $() bash command substitution syntax. This oversight allows attackers who can craft a valid encrypted payload to achieve arbitrary command execution on the standalone encoder server due to the use of sh -c within execAsync(). The vulnerability was patched in commit 25c8ab90269e3a01fb4cf205b40a373487f022e1. Exploitation requires the attacker to be able to craft a valid encrypted payload.

Attack Chain

An attacker crafts a malicious encrypted payload containing a command injection payload leveraging the $() bash command substitution.
The attacker uploads or injects this payload into the AVideo platform.
AVideo processes the malicious payload, passing it to the sanitizeFFmpegCommand() function.
The sanitizeFFmpegCommand() function fails to properly sanitize the $() bash command substitution syntax within the payload.
The unsanitized command is then executed within a double-quoted sh -c context in the execAsync() function.
The sh -c interpreter executes the injected command, resulting in arbitrary code execution on the standalone encoder server.
The attacker gains control of the server, potentially leading to data exfiltration, system compromise, or further lateral movement.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the AVideo standalone encoder server. This can lead to complete system compromise, including data exfiltration, modification, or deletion. Given the nature of AVideo as a video platform, attackers could also inject malicious content into videos served by the platform, potentially affecting a large number of users.

Recommendation

Apply the patch from commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 to remediate CVE-2026-33482.
Deploy the Sigma rule "Detect AVideo Command Injection Attempt" to detect potential exploitation attempts in web server logs.
Monitor web server logs for suspicious requests containing shell metacharacters, especially $(), targeting the plugin/API/standAlone/functions.php path.

AVideo Unauthenticated Access to Payment Log DataTables Endpoints

hello@craftedsignal.io — Mon, 29 Jan 2024 12:00:00 +0000

AVideo, a video sharing platform, contains a critical vulnerability affecting multiple payment plugins. The vulnerability stems from the lack of authentication checks on list.json.php endpoints, which expose sensitive payment transaction data. This oversight allows unauthenticated attackers to retrieve payment records from PayPal, Authorize.Net, and Bitcoin payment providers. The issue mirrors a previously patched vulnerability in the Scheduler plugin (GHSA-j724-5c6c-68g5) but was not consistently applied across all affected endpoints. A total of 21 list.json.php endpoints remain vulnerable. The affected version is <= 26.0. This vulnerability poses a significant threat to AVideo users, potentially leading to financial data theft and unauthorized access to sensitive information.

Attack Chain

An unauthenticated attacker identifies a vulnerable AVideo instance.
The attacker crafts a GET request to a vulnerable list.json.php endpoint, such as plugin/PayPalYPT/View/PayPalYPT_log/list.json.php.
The AVideo server processes the request without authentication and executes the associated PHP script.
The script queries the database, retrieving all records from the corresponding table (e.g., PayPalYPT_log).
The server returns a JSON-encoded response containing the retrieved data, including sensitive payment information.
The attacker parses the JSON response to extract PayPal agreement IDs, Express Checkout tokens, Authorize.Net webhook payloads, or Bitcoin transaction details.
The attacker uses the extracted tokens or payment information for malicious purposes, such as payment manipulation or account correlation.

Impact

Successful exploitation of this vulnerability leads to significant data exposure. Attackers can retrieve all payment transaction records across PayPal, Authorize.Net, and Bitcoin payment providers. This includes sensitive data such as PayPal Express Checkout tokens and billing agreement IDs, potentially enabling payment manipulation or account correlation. Transaction records contain user ID mappings, payment amounts, and full API responses that may include payer email addresses and names. The scope is broad, affecting 21 list.json.php endpoints, also exposing live streaming server infrastructure and user connection data. No authentication or user interaction is required.

Recommendation

Apply the provided code snippet to all unprotected list.json.php endpoints to enforce authentication checks using User::isAdmin() as detailed in the advisory's recommended fix.
Monitor web server access logs for requests to list.json.php endpoints located within AVideo plugin directories using the rule AVideo Unauthenticated Access to list.json.php.
Inspect network traffic for sensitive data being transmitted in cleartext from the vulnerable endpoints, such as PayPal tokens, using the rule AVideo Sensitive Data Exposure via Unauthenticated Endpoint.

AVideo CDN Plugin Unauthenticated Configuration Modification

hello@craftedsignal.io — Mon, 29 Jan 2024 12:00:00 +0000

AVideo, an open source video platform, contains a critical vulnerability (CVE-2026-33719) within its CDN plugin. Versions up to and including 26.0 are affected. The vulnerability stems from the endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php using key-based authentication with an empty string as the default key. Critically, when the CDN plugin is enabled but the key remains at its default (empty) state, the authentication check is bypassed entirely. This allows any unauthenticated attacker to fully modify the CDN configuration through mass-assignment via the par request parameter. This includes the ability to manipulate CDN URLs, storage credentials, and even the authentication key itself. A patch has been released in commit adeff0a31ba04a56f411eef256139fd7ed7d4310. This is significant because it can lead to complete compromise of the video delivery infrastructure.

Attack Chain

An attacker identifies an AVideo instance with the CDN plugin enabled.
The attacker checks the CDN configuration by sending a GET request to plugin/CDN/status.json.php without any authentication headers to confirm if CDN plugin is enabled and running with default configuration.
If the CDN key is the default empty string, the attacker crafts a malicious POST request to plugin/CDN/status.json.php or plugin/CDN/disable.json.php.
The POST request includes the par parameter containing a JSON object with modified CDN settings, such as CDN URLs and storage credentials.
Due to the bypassed authentication, the AVideo server processes the request and updates the CDN configuration.
The attacker can modify the CDN URL to point to a malicious server hosting malware or phishing content.
Legitimate users requesting video content are redirected to the attacker's malicious CDN.
The attacker can also steal storage credentials and compromise the CDN's data.

Impact

Successful exploitation of CVE-2026-33719 allows an unauthenticated attacker to take complete control over the video delivery infrastructure. This can result in serving malicious content to users, data exfiltration from the CDN storage, or complete disruption of video services. The number of victims depends on the popularity of the affected AVideo instances. This vulnerability impacts any organization using AVideo with the CDN plugin enabled and the default configuration, including educational institutions, media companies, and content creators.

Recommendation

Apply the patch from commit adeff0a31ba04a56f411eef256139fd7ed7d4310 or upgrade to a version of AVideo that includes this fix to remediate CVE-2026-33719.
Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts targeting the plugin/CDN/status.json.php and plugin/CDN/disable.json.php endpoints.
Monitor web server logs for POST requests to plugin/CDN/status.json.php or plugin/CDN/disable.json.php endpoints without proper authentication headers, as these may indicate an attempted exploit.
As a temporary workaround, configure a strong, non-default key for the CDN plugin to prevent the authentication bypass.

AVideo CORS Origin Reflection with Credentials Leads to Account Takeover

hello@craftedsignal.io — Fri, 26 Jan 2024 18:21:00 +0000

AVideo, a video-sharing platform, contains a critical vulnerability in its CORS implementation. The allowOrigin($allowAll=true) function in objects/functions.php unconditionally reflects the Origin header, along with Access-Control-Allow-Credentials: true, on the plugin/API/get.json.php and plugin/API/set.json.php endpoints. These API endpoints handle sensitive user data retrieval, authentication, and state-changing operations. Combined with the application's SameSite=None session cookie policy, this allows attackers to bypass CORS restrictions, enabling credentialed cross-origin requests. By hosting a malicious webpage, an attacker can steal user PII (email, name, address, phone number, birth date), livestream credentials, and perform unauthorized actions on behalf of a logged-in user. This vulnerability affects AVideo versions 29.0 and earlier. The issue was introduced due to an oversight in a previous fix (commit 986e64aad) which addressed CORS handling for null origins but neglected the more dangerous $allowAll=true path.

Attack Chain

The attacker crafts a malicious HTML page hosted on a domain they control (e.g., attacker.example). This page contains JavaScript code designed to make a cross-origin request to the vulnerable AVideo instance.
A logged-in AVideo user visits the attacker's malicious page.
The JavaScript on the attacker's page sends a credentialed GET request to the https://TARGET/plugin/API/get.json.php?APIName=user endpoint with credentials: 'include'.
The AVideo server's allowOrigin function reflects the attacker's origin in the Access-Control-Allow-Origin header, along with setting Access-Control-Allow-Credentials: true.
The attacker's JavaScript receives the API response containing the victim's sensitive data, including email, name, address, phone number, admin status, livestream server URL with embedded password, and encrypted stream key.
The attacker exfiltrates the stolen data to their server (e.g., https://attacker.example/collect) using navigator.sendBeacon.
(Optional) The attacker crafts further requests to set.json.php to perform actions on the victim's behalf, such as modifying video settings or other account-related configurations.

Impact

Successful exploitation allows an attacker to steal sensitive user data, including email, full name, address, phone number, and birth date, from any logged-in user who visits the attacker-controlled page. The attacker can also compromise user accounts by stealing livestream credentials, allowing them to hijack live streams. Exposure of admin status and permissions facilitates targeted attacks on privileged accounts. Furthermore, the attacker can perform state modifications on behalf of the victim through the set.json.php endpoint, potentially disrupting service or causing further damage. Due to the nature of the vulnerability, a single attacker page can harvest data from every logged-in visitor, leading to mass exploitation.

Recommendation

Deploy the Sigma rule Detect AVideo API Access From Unknown Origins to identify requests to the vulnerable API endpoints originating from domains not explicitly allowed.
Apply the recommended fix provided in the advisory by replacing the permissive origin reflection in the allowOrigin() function with proper validation against the site's configured domain.
Audit webserver logs for requests to /plugin/API/get.json.php and /plugin/API/set.json.php where the Origin header does not match the expected domain to identify potential exploitation attempts (reference IOC: vulnerable API endpoint).
Consider separating truly public endpoints from sensitive API endpoints with different CORS policies.
Monitor network traffic for connections to attacker-controlled domains like attacker.example (reference IOC: attacker controlled domain).

AVideo Remote Code Execution via Polyglot File Upload (CVE-2026-33647)

hello@craftedsignal.io — Wed, 24 Jan 2024 12:00:00 +0000

AVideo, an open-source video platform, is susceptible to remote code execution (RCE) in versions up to and including 26.0 due to a flaw in the ImageGallery::saveFile() method. This vulnerability, identified as CVE-2026-33647, arises from the inadequate validation of uploaded files. Specifically, the system uses finfo for MIME type detection but relies on the user-supplied filename extension without proper sanitization. An attacker can leverage this weakness by crafting a polyglot file, embedding malicious PHP code within a seemingly benign JPEG image, and naming it with a .php extension. This bypasses the MIME type check, causing the file to be saved as an executable PHP file within a web-accessible directory. The vulnerability was patched in commit 345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae. Successful exploitation grants the attacker the ability to execute arbitrary code on the AVideo server, leading to potential data breaches, system compromise, and service disruption.

Attack Chain

The attacker identifies an AVideo instance running a vulnerable version (<= 26.0).
The attacker crafts a polyglot file. This file is a valid JPEG image with PHP code appended. The file is named with a .php extension (e.g., evil.php).
The attacker uses the AVideo web interface, specifically the image upload functionality within ImageGallery::saveFile(), to upload the malicious evil.php file.
The ImageGallery::saveFile() method uses finfo to check the MIME type of the uploaded file. Because the file starts with JPEG magic bytes, it passes the MIME type check.
Due to the missing allowlist on the filename extension, the file is saved with the attacker-controlled .php extension.
The file is saved in a web-accessible directory on the AVideo server.
The attacker sends an HTTP request to the uploaded PHP file (e.g., https://avideo.example.com/uploads/evil.php).
The web server executes the PHP code embedded within the evil.php file, granting the attacker remote code execution on the server.

Impact

Successful exploitation of CVE-2026-33647 allows an attacker to execute arbitrary code on the AVideo server. This can lead to a full system compromise, including the ability to read and modify sensitive data, install malware, pivot to other systems on the network, and disrupt service availability. The impact depends on the privileges of the web server process. Given the nature of video platforms, successful attacks can also lead to defacement and distribution of malicious content.

Recommendation

Apply the patch from commit 345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae to remediate CVE-2026-33647 immediately.
Implement strict allowlisting for file extensions in the ImageGallery::saveFile() method to prevent the upload of executable files.
Deploy the provided Sigma rule to detect potential attempts to exploit CVE-2026-33647 by monitoring for the execution of PHP files within the web server's upload directories.
Review webserver logs for suspicious requests to PHP files in upload directories for potential exploitation attempts (log source: webserver).

AVideo Platform Unauthenticated Live Stream Control via streamerURL Manipulation

hello@craftedsignal.io — Wed, 17 Jan 2024 12:00:00 +0000

AVideo, an open-source video platform, is vulnerable to an authentication bypass flaw affecting versions up to and including 26.0. The vulnerability resides in the plugin/Live/standAloneFiles/control.json.php endpoint, which handles live stream control. By manipulating the streamerURL parameter, a malicious actor can redirect token verification requests to a server under their control. This malicious server is designed to always return a positive authentication response ({"error": false}), effectively bypassing the intended authentication process. This allows an unauthenticated attacker to take complete control over any live stream hosted on the platform. The vulnerability was patched in commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128. This vulnerability poses a severe risk to AVideo platforms as it could lead to unauthorized modification or disruption of live streams.

Attack Chain

The attacker identifies an AVideo platform running a vulnerable version (<= 26.0).
The attacker crafts a malicious HTTP POST request targeting the plugin/Live/standAloneFiles/control.json.php endpoint.
Within the POST request, the attacker includes the streamerURL parameter, setting its value to a URL pointing to a server under their control.
The attacker's server is configured to respond to any token verification request with a JSON response: {"error": false}.
The AVideo platform, upon receiving the crafted request, sends a token verification request to the attacker-controlled streamerURL.
The attacker's server responds with {"error": false}, tricking the AVideo platform into believing the user is authenticated.
The attacker can then use other parameters in the control.json.php endpoint to perform unauthorized actions on live streams, such as dropping active publishers.
The attacker can also start/stop recordings or probe for the existence of live streams.

Impact

Successful exploitation of CVE-2026-33716 allows an unauthenticated attacker to gain full control over live streams on the affected AVideo platform. This can lead to various detrimental outcomes, including unauthorized termination of legitimate streams, injection of malicious content into live broadcasts, and disruption of service. The CVSS v3.1 base score for this vulnerability is 9.4, indicating a critical severity level. The number of affected AVideo platforms is unknown, but any instance running a version up to 26.0 is susceptible to this attack.

Recommendation

Apply the patch from commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 to remediate CVE-2026-33716.
Deploy the Sigma rule to detect exploitation attempts against the plugin/Live/standAloneFiles/control.json.php endpoint.
Monitor web server logs for POST requests to plugin/Live/standAloneFiles/control.json.php containing the streamerURL parameter.

AVideo SSRF Vulnerability via IPv4-Mapped IPv6 Bypass (CVE-2026-33480)

hello@craftedsignal.io — Tue, 16 Jan 2024 12:00:00 +0000

AVideo, an open-source video platform, is vulnerable to a Server-Side Request Forgery (SSRF) attack. Specifically, versions up to and including 26.0 contain a flaw in the isSSRFSafeURL() function. This function, intended to prevent SSRF attacks, can be bypassed using IPv4-mapped IPv6 addresses (e.g., ::ffff:x.x.x.x). The vulnerability is located in the plugin/LiveLinks/proxy.php endpoint, which lacks proper authentication. An attacker can exploit this to make arbitrary HTTP requests to internal resources, cloud metadata endpoints, and localhost services. This issue was addressed in commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373. The CVSS v3.1 score is 8.6, indicating a high level of severity.

Attack Chain

An attacker identifies an AVideo instance running a vulnerable version (<= 26.0).
The attacker crafts a malicious URL using an IPv4-mapped IPv6 address, such as ::ffff:127.0.0.1.
The attacker sends an HTTP request to the plugin/LiveLinks/proxy.php endpoint, providing the malicious URL as a parameter.
The isSSRFSafeURL() function fails to properly validate the IPv4-mapped IPv6 address.
The proxy.php script uses curl (or a similar function) to fetch the content from the attacker-controlled URL.
The curl request is sent to the target specified within the IPv6-mapped address (e.g., localhost).
The attacker gains access to sensitive information from internal services, cloud metadata, or localhost.
The attacker may further exploit accessed services or exfiltrate data depending on the internal resources exposed.

Impact

Successful exploitation of this SSRF vulnerability allows unauthenticated attackers to read sensitive information from internal services, cloud metadata endpoints, and localhost services. This can lead to the disclosure of API keys, configuration files, internal network layouts, and potentially allow further exploitation of other internal systems. The lack of authentication on the affected endpoint greatly increases the potential for widespread abuse, particularly in cloud environments where metadata services are readily accessible.

Recommendation

Apply the patch from commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373 to remediate CVE-2026-33480.
Monitor web server logs for requests to the plugin/LiveLinks/proxy.php endpoint containing IPv4-mapped IPv6 addresses using the provided Sigma rule.
Implement network segmentation and firewall rules to restrict access from the AVideo server to internal resources to mitigate the impact of successful SSRF attacks.

AVideo SQL Injection Vulnerability (CVE-2026-33651)

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

AVideo, an open-source video platform, is susceptible to a critical SQL injection vulnerability (CVE-2026-33651) affecting versions up to and including 26.0. The vulnerability lies within the remindMe.json.php endpoint, where the $_REQUEST['live_schedule_id'] parameter is mishandled. Despite attempts to sanitize the input using intval() within intermediate functions, the original tainted variable remains unsanitized before being directly concatenated into a SQL LIKE clause within Scheduler_commands::getAllActiveOrToRepeat(). This flaw enables any authenticated user to perform time-based blind SQL injection attacks. The vulnerability was patched in commit 75d45780728294ededa1e3f842f95295d3e7d144. Successful exploitation could lead to unauthorized access and exfiltration of sensitive database information.

Attack Chain

An attacker authenticates to the AVideo platform with valid credentials.
The attacker crafts a malicious HTTP request targeting the remindMe.json.php endpoint.
The attacker injects SQL code into the live_schedule_id parameter within the request. This parameter is passed unsanitized to the vulnerable function.
The remindMe.json.php script processes the request, passing the tainted live_schedule_id to Scheduler_commands::getAllActiveOrToRepeat().
Scheduler_commands::getAllActiveOrToRepeat() concatenates the injected SQL code into a LIKE clause within a SQL query.
The application executes the malicious SQL query against the AVideo database.
The attacker uses time-based techniques to infer the results of the injected SQL query, extracting data bit by bit.
The attacker successfully exfiltrates sensitive information from the database, such as user credentials, configuration settings, or other confidential data.

Impact

Successful exploitation of CVE-2026-33651 allows any authenticated user to perform time-based blind SQL injection attacks, leading to the complete compromise of the AVideo database. This can result in the exfiltration of sensitive data, including user credentials and system configurations. Given that AVideo is a video platform, the exposed data could also include information about video content, user activity, and potentially even the videos themselves. The number of affected installations is unknown.

Recommendation

Apply the patch from commit 75d45780728294ededa1e3f842f95295d3e7d144 to remediate CVE-2026-33651.
Deploy the Sigma rule "Detect AVideo SQL Injection Attempt" to detect exploitation attempts against the remindMe.json.php endpoint.
Monitor web server logs for suspicious requests containing SQL syntax in the live_schedule_id parameter of the remindMe.json.php endpoint.
Implement input validation and sanitization for all user-supplied input to prevent SQL injection vulnerabilities.

AVideo Session Fixation Vulnerability (CVE-2026-33492)

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

AVideo, an open-source video platform, is vulnerable to a session fixation attack (CVE-2026-33492) in versions up to and including 26.0. The vulnerability stems from the _session_start() function, which improperly accepts arbitrary session IDs via the PHPSESSID GET parameter. Furthermore, session regeneration is bypassed for specific blacklisted endpoints when the request originates from the same domain. Critically, the User::login() function explicitly disables session regeneration. This combination allows an attacker to set a victim's session ID before they authenticate, and subsequently hijack their authenticated session. This is a critical vulnerability as it can lead to complete account takeover. A patch is available in commit 5647a94d79bf69a972a86653fe02144079948785.

Attack Chain

Attacker identifies a vulnerable AVideo instance (version 26.0 or earlier).
Attacker crafts a malicious link or uses another method to send the victim a URL to the AVideo site that includes a PHPSESSID parameter with a session ID controlled by the attacker (e.g., https://example.com/?PHPSESSID=attacker_session_id).
The victim clicks the link and their browser sets the PHPSESSID cookie to the attacker-controlled value. The AVideo server starts a PHP session using the provided session ID.
The victim logs into the AVideo platform. The User::login() function, due to the vulnerability, does not regenerate the session ID upon successful authentication.
The victim's authenticated session continues to use the attacker-controlled PHPSESSID.
The attacker uses the same PHPSESSID value in their own browser to access the AVideo site.
The AVideo server authenticates the attacker as the victim because the session ID matches the victim's authenticated session.
The attacker now has complete access to the victim's account, including their videos, personal information, and administrative privileges if applicable.

Impact

Successful exploitation of this vulnerability allows an attacker to completely take over a user's account on the AVideo platform. This could lead to unauthorized access to sensitive video content, modification or deletion of videos, defacement of the platform, or further attacks leveraging the compromised account. The number of potential victims depends on the number of vulnerable AVideo instances and their user base, but the impact is significant for each compromised account.

Recommendation

Apply the patch available in commit 5647a94d79bf69a972a86653fe02144079948785 to remediate the session fixation vulnerability.
Deploy the Sigma rule Detect AVideo Session Fixation Attempt via PHPSESSID GET Parameter to identify potential exploitation attempts (Sigma rule).
Monitor web server logs for requests containing the PHPSESSID parameter in the query string to identify potential session fixation attempts (webserver logs).
Consider implementing a web application firewall (WAF) rule to block requests containing the PHPSESSID parameter in the query string (webserver logs).

AVideo EncoderReceiveImage Local File Inclusion Vulnerability

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

AVideo, a video sharing platform, is vulnerable to a local file inclusion vulnerability (CVE-2026-39369) in versions 26.0 and earlier. The vulnerability exists in the objects/aVideoEncoderReceiveImage.json.php endpoint, which is accessible to authenticated users with uploader privileges. By manipulating the downloadURL_gifimage parameter with a specially crafted URL containing path traversal sequences, an attacker can bypass input sanitization and force the application to read arbitrary files from the server's filesystem. The application then writes the content of the file into a GIF, making it accessible via a public media URL. This allows attackers to retrieve sensitive information such as configuration files, source code, and system credentials.

Attack Chain

Attacker logs in to AVideo as an authenticated user with uploader privileges.
Attacker crafts a malicious POST request to objects/aVideoEncoderReceiveImage.json.php with the downloadURL_gifimage parameter.
The downloadURL_gifimage parameter contains a URL with path traversal sequences (e.g., ....//....//) targeting a sensitive file on the server (e.g., /etc/passwd).
The application attempts to sanitize the URL using str_replace('../', '', ...) but fails due to the overlapping traversal sequence.
The application resolves the manipulated URL, resulting in a read operation from the targeted file on the local filesystem using url_get_contents() or try_get_contents_from_local().
The content of the targeted file is retrieved and written into a GIF image file on the server's disk.
The attacker uses objects/videos.json.php?showAll=1 to recover the generated GIF URL from videosURL.gif.url.
The attacker accesses the GIF URL, retrieves the file content, and obtains sensitive information.

Impact

Successful exploitation of this vulnerability allows an attacker to read arbitrary files on the AVideo server. This can lead to the disclosure of sensitive information, including configuration files, source code, and system credentials, potentially leading to further compromise of the server and the AVideo platform. This impacts any AVideo instance running version 26.0 or earlier and puts all associated data at risk.

Recommendation

Apply the recommended fixes from WWBN: Reject any remote image URL whose decoded path contains traversal markers.
Apply the recommended fixes from WWBN: Do not allow attacker-controlled same-origin /videos/... fetches to resolve into local file reads.
Apply the recommended fixes from WWBN: Constrain any local shortcut path handling with realpath() and strict base-directory allowlists.
Apply the recommended fixes from WWBN: Validate GIF content before saving it into public media storage.
Apply the recommended fixes from WWBN: Ensure invalid-image cleanup checks the correct destination path.
Deploy the Sigma rule Detect AVideo LFI Attempt to detect exploitation attempts against the aVideoEncoderReceiveImage.json.php endpoint.
Monitor web server logs for HTTP requests to /objects/aVideoEncoderReceiveImage.json.php containing path traversal sequences in the downloadURL_gifimage parameter.