The flaw resides in the view/update.php script of WWBN AVideo 29.0 and earlier, where the $_POST['updateFile'] parameter is treated as a relative path and fed directly to PHP's file() function. This allows an authenticated administrator to read the contents of any text file that the web‑server process can access, thereby leaking potentially sensitive data. The weakness is a classic path‑traversal issue, identified as CWE‑22, and the vulnerability is rated with a CVSS score of 6.9, indicating a moderate to high severity.

The affected product is WWBN AVideo, version 29.0 and all earlier releases.

Because the attack requires administrator credentials, the threat surface is narrowed to the inside of the organization. The CVSS score suggests a significant risk if the vulnerability is exploited. The EPSS score is not available, so the precise likelihood of exploitation remains unknown, but the absence of a KEV listing indicates no public exploitation reports yet. Nonetheless, the potential for confidential information disclosure warrants prompt action once the applicable patch or mitigation is applied.