CVE-2026-41062

WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for "objects/aVideoEncoderReceiveImage.json.php" only checks the URL path component via "parseurl$url, PHPURLPATH" for ".." sequences. However, the downstream...

CVE-2026-41062: Improper Limitation of a Pathname to a Restricted Directory

WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for objects/aVideoEncoderReceiveImage.json.php only checks the URL path component via parseurl$url, PHPURLPATH for .. sequences. However, the downstream function...

PT-2026-35120

Summary The directory traversal fix introduced in commit 2375eb5e0 for objects/aVideoEncoderReceiveImage.json.php only checks the URL path component via parse url$url, PHP URL PATH for .. sequences. However, the downstream function try get contents from local in objects/functionsFile.php uses...