Technical impact
An unauthenticated attacker can retrieve the application's .env file because the official Docker compose configuration mounts the entire project root as the Apache document root without protecting dotfiles. This is a case of CWE‑20 (Improper Input Validation), leading to insecure path exposure. The .env file contains database credentials, admin passwords, and infrastructure configuration, so downloading it exposes credentials that can be used to access the database and potentially the admin panel, enabling lateral movement across the Docker network. This results in a high severity data disclosure.
Affected Systems
WWBN AVideo is the affected product. All releases prior to version 29.0 are vulnerable because they employ the default Docker compose that does not restrict access to the .env file.
Risk and Exploitability
The CVSS score of 7.5 indicates high severity. The EPSS score of < 1% suggests a low likelihood of exploitation, and the vulnerability is currently not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via HTTP on the web server; no authentication is required. An attacker can simply request /.env from the exposed document root to obtain credentials, assuming the service is publicly reachable.
Github GHSA