An authenticated user with upload privileges can submit a chunkFile parameter that points to any local file on the server. The endpoint accepts the path if it passes a relaxed validation routine, then copies the chosen file into the user’s public video storage and serves it over HTTP. This provides the attacker with the ability to read any file that the web server process can access, including configuration files, credentials, or other sensitive data, thereby compromising confidentiality.

The vulnerability affects WWBN AVideo versions up to and including 26.0. The flaw resides in the POST /objects/aVideoEncoder.json.php endpoint used for staged video uploads, where the chunkFile path is not properly restricted to trusted server‑generated locations.

The issue carries a CVSS score of 7.6, indicating high severity. Its EPSS score is below 1%, and it is not listed in the CISA known exploited vulnerabilities catalog, suggesting low current exploitation activity. Once authenticated, the attacker can craft a path to any readable file, copy it into a publicly accessible location, and download it. If file permissions permit, critical files such as /etc/passwd or application configuration files could be exposed.