CVE-2026-39369

🗓️ 07 Apr 2026 19:24:33Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 13 Views🌐 WEB

CVE-2026-39369: WWBN AVideo GIF poster bypasses traversal scrubbing, exposing local files via public URLs.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-39369	7 Apr 202619:24	–	attackerkb
Circl	CVE-2026-39369	6 Apr 202612:41	–	circl
CNNVD	WWBN AVideo 路径遍历漏洞	7 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-39369 WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs	7 Apr 202619:24	–	cvelist
EUVD	EUVD-2026-19883	8 Apr 202600:08	–	euvd
Github Security Blog	WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs	8 Apr 202600:08	–	github
GitLab Advisory Database	WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs	8 Apr 202600:00	–	gitlab
NVD	CVE-2026-39369	7 Apr 202620:16	–	nvd
OSV	CVE-2026-39369 WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs	7 Apr 202619:24	–	osv
OSV	GHSA-F4F9-627C-JH33 WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs	8 Apr 202600:08	–	osv

NVD

Vulners

Node

wwbn avideoRange≤26.0

[
  {
    "vendor": "WWBN",
    "product": "AVideo",
    "versions": [
      {
        "version": "<= 26.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/WWBN/AVideo/security/advisories/GHSA-f4f9-627c-jh33
github	www.github.com/WWBN/AVideo/commit/2375eb5e0a6d3cbcfb05377657d0820a7d470b1d

Parameter	Position	Path	Description	CWE
url	request body	objects/aVideoEncoderReceiveImage.json.php	Authenticated uploader can cause the endpoint to fetch attacker-controlled same-origin /videos/... URLs and read local files via the GIF poster storage path, exposing server-local files.	CWE-22

17 Jun 2026 10:42Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.6

EPSS0.00412

SSVC

CWE-22