An unauthenticated attacker can retrieve the application's .env file because the official Docker compose configuration mounts the entire project root as the Apache document root without protecting dotfiles. This is a case of CWE‑20 (Improper Input Validation), leading to insecure path exposure. The .env file contains database credentials, admin passwords, and infrastructure configuration, so downloading it exposes credentials that can be used to access the database and potentially the admin panel, enabling lateral movement across the Docker network. This results in a high severity data disclosure.

WWBN AVideo is the affected product. All releases prior to version 29.0 are vulnerable because they employ the default Docker compose that does not restrict access to the .env file.

The CVSS score of 7.5 indicates high severity. The EPSS score of < 1% suggests a low likelihood of exploitation, and the vulnerability is currently not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via HTTP on the web server; no authentication is required. An attacker can simply request /.env from the exposed document root to obtain credentials, assuming the service is publicly reachable.