Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2026-33292 is a high-severity Path Traversal (CWE-22) vulnerability in Wwbn Avideo. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33292 is a path traversal vulnerability (CWE-22) affecting WWBN AVideo, an open source video platform, in versions prior to 26.0. The issue resides in the HLS streaming endpoint at `view/hls.php`, where the `videoDirectory` GET parameter is processed differently in two code paths: one for authorization that truncates at the first `/` segment, and another for file access that preserves `..` traversal sequences. This discrepancy creates a split-oracle condition, enabling unauthorized access to video files. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
An unauthenticated attacker can exploit this vulnerability remotely with low complexity by manipulating the `videoDirectory` parameter to traverse directories and access any private or paid video on the platform. Successful exploitation allows the attacker to stream restricted video content without proper authorization, bypassing access controls while the system checks permissions against a different, authorized video path.
The WWBN AVideo security advisory (GHSA-pw4v-x838-w5pg) and the fixing commit (bc034066281085af00e64b0d7b81d8a025a928c4) confirm that upgrading to version 26.0 resolves the issue by addressing the divergent handling of the `videoDirectory` parameter. Security practitioners should prioritize patching affected instances to prevent unauthorized video streaming.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14315
Vulnerability Data
WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint (`view/hls.php`) is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The…
more
`videoDirectory` GET parameter is used in two divergent code paths — one for authorization (which truncates at the first `/` segment) and one for file access (which preserves `..` traversal sequences) — creating a split-oracle condition where authorization is checked against one video while content is served from another. Version 26.0 contains a fix for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces the intended directory access authorizations that path traversal would otherwise bypass.
Input validation directly neutralizes special path elements before pathname construction occurs.
Least privilege reduces the impact of any unauthorized file access obtained via traversal.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements include rules for safe file handling and canonicalization.
Secure architecture principles require least-privilege file access and directory isolation.
Secure coding standards explicitly forbid unsafe path construction and mandate safe APIs.
Information access restriction limits which files an application may read or write.