CVE-2026-41062: 
PHP vulnerability analysis and mitigation

CVE-2026-41062 is a directory traversal vulnerability (path traversal bypass) in WWBN AVideo, an open-source video platform. It affects AVideo versions 29.0 and below and represents an incomplete fix for a prior traversal vulnerability — the security check introduced in commit 2375eb5 only inspects the URL path component via parse_url($url, PHP_URL_PATH), leaving the query string unvalidated. An authenticated attacker with low privileges can place traversal sequences in the query string to read arbitrary files from the server filesystem. It carries a CVSS v3.1 base score of 6.5 (Medium) (GHSA-m63r-m9jh-3vc6).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The incomplete fix in objects/aVideoEncoderReceiveImage.json.php calls parse_url($url, PHP_URL_PATH) to extract only the path component for .. detection — so a URL like http://TARGET/x?a=/videos/../../etc/passwd passes the check because parse_url returns /x as the path with no .. present. The downstream function try_get_contents_from_local() in objects/functionsFile.php then uses explode('/videos/', $url) on the full URL string including the query string, causing $parts[1] to resolve to ../../../../../../etc/passwd, which PHP's filesystem functions resolve outside the intended directory. All four downloadURL_* parameters (downloadURL_image, downloadURL_gifimage, downloadURL_webpimage, downloadURL_spectrumimage) are affected. The URL also bypasses isSSRFSafeURL() because the host matches webSiteRootURL, triggering an early return (GHSA-m63r-m9jh-3vc6, Commit bd11c16).

An authenticated user with upload permission can read arbitrary files accessible to the web server process, including /etc/passwd, application source code, and configuration files such as videos/configuration.php which may contain database credentials. Files that pass image validation (PNG/JPEG/GIF) are fully exfiltrable via the video thumbnail URL; for non-image files (e.g., /etc/passwd), file existence and size are leaked through the jpgDestSize response field, and a race condition exists between the write and deletion by deleteInvalidImage() that may allow content retrieval. There is no integrity or availability impact — the vulnerability is limited to high confidentiality impact (GHSA-m63r-m9jh-3vc6).

Public proof-of-concept exploit steps are available in both GitHub Security Advisories (GHSA-m63r-m9jh-3vc6 and GHSA-f4f9-627c-jh33), including concrete curl commands targeting real AVideo deployments. Exploitation requires a valid authenticated session with upload permission and knowledge of a videos_id owned by the attacker. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.117%, reflecting low but non-zero exploitation probability (GHSA-m63r-m9jh-3vc6, Feedly).

1. Authenticate: Log in to the target AVideo instance with a low-privilege account that has upload permission and obtain a valid PHPSESSID session cookie.
2. Identify a target video: Obtain the videos_id of a video owned by the attacker account (created via the normal encoder flow).
3. Craft the traversal payload: Construct a URL placing the traversal sequence in the query string rather than the path, e.g., http://avideo.example.com/x?a=/videos/../../../../../../etc/passwd. This bypasses the parse_url(..., PHP_URL_PATH) check since the path component is /x with no ...
4. Send the malicious POST request: Submit the payload to the ReceiveImage endpoint:

curl -s -b "PHPSESSID=<session_cookie>" \
  "https://avideo.example.com/objects/aVideoEncoderReceiveImage.json.php" \
  -d "videos_id=<YOUR_VIDEO_ID>" \
  -d "downloadURL_image=http://avideo.example.com/x?a=/videos/../../../../../../etc/passwd"

5. Confirm file read: Observe the jpgDestSize field in the JSON response — a non-zero value confirms the target file was read and written to the thumbnail path.
6. Retrieve image-valid files: For files that pass image validation (e.g., PNG/JPEG files at known paths), retrieve the content via the video's public thumbnail URL: curl -s "https://avideo.example.com/videos/<video_thumbnail>.jpg"
7. Race condition for non-image files: For non-image files like /etc/passwd, rapidly attempt to retrieve the written file before deleteInvalidImage() removes it, exploiting the write-then-delete race window (GHSA-m63r-m9jh-3vc6).

• Network: Unusual POST requests to /objects/aVideoEncoderReceiveImage.json.php with downloadURL_* parameters containing query strings with /videos/../../ or similar traversal patterns; same-origin URLs with query strings referencing paths outside the videos directory.
• Logs: Web server access logs showing POST requests to aVideoEncoderReceiveImage.json.php with encoded traversal sequences (e.g., %2e%2e, ....//) in parameter values; AVideo error logs containing entries like try_get_contents_from_local: blocked path traversal attempt (present only after the patched version is deployed).
• File System: Unexpected temporary files appearing in the AVideo videos/thumbnails directory with content matching system files (e.g., /etc/passwd content); thumbnail files for videos that were recently modified with anomalous content or file sizes inconsistent with image data.
• Application Response: JSON responses from aVideoEncoderReceiveImage.json.php with non-zero jpgDestSize values corresponding to known system file sizes (e.g., /etc/passwd size) when no legitimate image upload was performed (GHSA-m63r-m9jh-3vc6).

Apply the fix in commit bd11c16ec894698e54e2cdae25026c61ad1ed441, which addresses the bypass in two places: (1) objects/aVideoEncoderReceiveImage.json.php now decodes and checks the full URL string (not just the path component) for .. sequences; (2) objects/functionsFile.php's try_get_contents_from_local() now uses realpath() with strict base-directory validation to ensure the resolved path stays within the videos directory. As a workaround prior to patching, restrict access to aVideoEncoderReceiveImage.json.php at the web server level or disable upload permissions for untrusted users. Upgrading to a version of AVideo that includes commit bd11c16 is the recommended remediation (GHSA-m63r-m9jh-3vc6, Commit bd11c16).

The vulnerability was reported by researcher offset and published by AVideo maintainer DanielnetoDotCom via GitHub Security Advisories. The advisory explicitly frames CVE-2026-41062 as an incomplete fix for a prior traversal issue (GHSA-f4f9-627c-jh33 / CVE-2026-39369), highlighting the risk of partial security patches. No significant broader media coverage or notable social media discussion beyond automated CVE tracking feeds has been observed (GHSA-m63r-m9jh-3vc6).