The vulnerability resides in the import.json.php endpoint, where a user-controlled fileURI POST parameter is only validated for a .mp4 suffix. This oversight allows an authenticated user with upload permissions to supply arbitrary file paths, enabling the reading of any file on the server’s filesystem that is adjacent to an .mp4 file. As a result, attackers can steal other users’ private videos, exfiltrate sensitive text or HTML files located next to video files, and delete both .mp4 files and their neighboring files if the web server process has write permission. The weakness is a classic path‑traversal flaw (CWE‑22).

The affected product is WWBN AVideo. All releases up to and including version 26.0 are vulnerable. Users running those versions of the platform are susceptible to the described attacks. The issue was known to the developers and a patch commit (e110ff542acdd7e3b81bdd02b8402b9f6a61ad78) addresses the flaw.

The CVSS score of 7.1 indicates a medium‑to‑high severity level. The EPSS score of less than 1% suggests that the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. However, the requirement for authenticated upload permission means that the attacker must be a recognized user, which could be feasible in environments with lax account controls. The lack of proper directory restrictions is the core exploit vector, and once an authenticated user exploits the flaw, they can perform the full set of actions described above. Prompt remediation is therefore advisable.