AVideo’s listFiles.json.php endpoint allows an authenticated user to pass any absolute path to the server, which the application then feeds directly to the glob() function. This path‑traversal flaw lets the attacker enumerate .mp4 files and discover their full filesystem paths, even outside the web root, exposing private media and other sensitive files.

The vulnerability affects the WWBN AVideo open‑source video platform. Versions prior to 26.0 are impacted; the fix was implemented in version 26.0.

The CVSS base score is 4.3 and the EPSS score is less than 1%, indicating a low probability of exploitation in the wild. The flaw is limited to authenticated uploaders, so an attacker would need valid credentials. However, the potential for confidential data leakage makes the issue significant enough to address promptly. The vulnerability is not listed in CISA’s KEV catalog.