Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-33292 is a path traversal vulnerability in the WWBN AVideo platform's HLS streaming endpoint (`view/hls.php`). It arises because the `videoDirectory` GET parameter is handled inconsistently in two parts of the code: authorization checks only consider the first segment of the path, while file access uses the full path including traversal sequences like `..`. This discrepancy allows an unauthenticated attacker to bypass authorization and stream any private or paid video by crafting a path that appears authorized but actually points to restricted content."}, {'type': 'paragraph', 'content': 'Specifically, the authorization function truncates the input at the first slash and checks permissions on that segment, while the file path construction preserves the full input, including `..` sequences, which the operating system resolves to access files outside the authorized directory. This split-oracle condition enables unauthorized streaming of protected videos.'}] [2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized access to private, unlisted, or paid videos on the AVideo platform without authentication.

• Any unauthenticated user can stream restricted content by exploiting the path traversal.
• Paid content can be accessed without payment, leading to monetization loss.
• Privacy of restricted videos is compromised as unauthorized users can view them.
• Content theft can occur at scale due to predictable video filename patterns.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access private or paid videos through the vulnerable HLS streaming endpoint using crafted requests that include path traversal sequences in the `videoDirectory` GET parameter.'}, {'type': 'paragraph', 'content': 'A practical detection method is to use curl commands to test if unauthorized video streaming is possible by exploiting the path traversal.'}, {'type': 'list_item', 'content': 'Check direct access denial to a private video: curl -s "https://target.com/view/hls.php?videoDirectory=private_video"'}, {'type': 'list_item', 'content': 'Test the path traversal exploit by requesting a public video directory with traversal to a private video: curl -s "https://target.com/view/hls.php?videoDirectory=public_video/../private_video" -H "Accept: application/vnd.apple.mpegurl"'}, {'type': 'list_item', 'content': 'Attempt to stream the private video segments using ffmpeg: ffmpeg -i "https://target.com/view/hls.php?videoDirectory=public_video/../private_video" -c copy stolen_video.mp4'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves applying input sanitization and path resolution checks to prevent path traversal attacks on the `videoDirectory` parameter.

• Reject any `videoDirectory` input containing `..` sequences at the start of the `view/hls.php` script.
• Normalize the `videoDirectory` parameter by replacing backslashes with forward slashes, trimming leading/trailing slashes, and collapsing multiple slashes.
• Implement a `realpath()` verification in the `getPathToFile()` method to ensure the resolved absolute path remains within the designated videos directory.

Upgrading to version 26.0 or later of WWBN AVideo, which contains the official fix for this vulnerability, is strongly recommended.

Useful 0 Not Useful 0