The vulnerability arises from an incomplete validation of the downloadURL query string in the AVideo ReceiveImage endpoint, allowing an attacker to supply a "/videos/../../" traversal payload that bypasses the path check and causes the server to retrieve local files. This directory traversal flaw can be exploited to read arbitrary files on the server, potentially exposing sensitive data such as configuration files, credentials, or source code and paving the way for further compromise.

WWBN AVideo versions 29.0 and earlier are affected, as they include the buggy handler functions. The issue was introduced in commit 2375eb5e0 and remains until the patch applied in commit bd11c16ec894698e54e2cdae25026c61ad1ed441.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is currently unavailable, suggesting that no high‑impact exploitation trend is documented. The vulnerability is not listed in the CISA KEV catalog. As the directory traversal is triggered via a crafted HTTP request, the likely attack vector is remote traffic directed at the API endpoint; an attacker only needs network access to the host. Given the impact of arbitrary file read, any compromise of this resource can lead to sensitive disclosure and further exploitation. While no active exploitation has been reported currently, the flaw warrants prompt remediation.