CVE-2026-43877
Path Traversal in WWBN AVideo
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wwbn | avideo | to 29.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in WWBN AVideo, an open source video platform, specifically in versions up to and including 29.0. The issue is in the legacy profile-photo endpoint objects/userSavePhoto.php, which accepts a base64 POST parameter and writes the decoded bytes to a user's profile photo file without proper security controls.
The endpoint only checks if the user is logged in (User::isLogged()) but lacks CSRF protection, Origin/Referer checks, and MIME validation of the uploaded data. Additionally, it is excluded from the project's global CSRF guard because it does not have the expected .json.php suffix.
Because the platform's default cookie policy is SameSite=None; Secure on HTTPS, an attacker can trick a logged-in user into visiting a malicious page that sends a forged request to overwrite that user's profile photo with arbitrary data. This request also triggers a site-wide cache clear.
How can this vulnerability impact me? :
This vulnerability allows an attacker to overwrite a logged-in user's profile photo with arbitrary data by exploiting the lack of CSRF protection and validation.
The impact includes the potential for malicious content to be uploaded as a profile photo, which could be used for defacement or to deliver harmful payloads.
Additionally, each forged request triggers a site-wide cache clear, which could degrade performance or availability temporarily.
The CVSS score of 5.4 indicates a medium severity with low attack complexity but requiring user interaction.