The vulnerability resides in the GIF poster generation component of WWBN AVideo. An authenticated uploader can request the same-origin /videos/... URL to trigger object/aVideoEncoderReceiveImage.json.php, which mistakenly allows directory traversal before accessing files in the GIF storage directory. This flaw lets a malicious user read arbitrary server‑side files, such as /etc/passwd or the application's source code, and ship them back through a publicly accessible GIF media URL. The weakness is a classic path traversal condition, specifically CWE‑22, and results in confidentiality loss of sensitive filesystem content.

The issue affects the open source WWBN AVideo platform, specifically all releases version 26.0 and earlier. Administrators or users who have uploaded content to the platform are able to exploit this flaw. Clients using older AVideo deployments are therefore at risk until the platform is updated.

The CVSS score of 7.6 indicates a high‑severity threat. Because the exploitation requires authentication as an uploader, an attacker must have valid account credentials, which reduces the overall attack surface compared to unauthenticated flaws. EPSS data is not available, and the vulnerability is not listed in the KEV catalog, but the high severity score suggests it should be treated with urgency. The attacker can compromise confidentiality but cannot directly execute code on the server through this vector.