7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33292

CVE-2026-33292: AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos

WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint (view/hls.php) is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The videoDirectory GET parameter is used in two divergent code paths — one for authorization (which truncates at the first / segment) and one for file access (which preserves .. traversal sequences) — creating a split-oracle condition where authorization is checked against one video while content is served from another. Version 26.0 contains a fix for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33292

CVE-2026-33292:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wwbn/avideo	composer	<= 25.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the vulnerability is based on the detailed security advisory provided, as no patch or commit information was available. The advisory clearly identifies a path traversal vulnerability in AVideo's HLS streaming endpoint (view/hls.php). The vulnerability stems from a split-oracle condition where the videoDirectory GET parameter is handled differently by two key functions.

Authorization Bypass (Video::getVideoFromFileName): The getVideoFromFileName function in objects/video.php truncates the input path at the first /, using only the initial segment for authorization checks. An attacker can use the directory of a public video as the first segment to pass this check.
Path Traversal (Video::getPathToFile): The getPathToFile function, also in objects/video.php, uses the full, unsanitized input path to construct the file path for video streaming. It does not filter out path traversal sequences (..), allowing an attacker to access files in other directories.

By crafting a videoDirectory parameter like public_video/../private_video, an attacker can successfully bypass the authorization for public_video while causing the system to serve the content of private_video. The identified vulnerable functions, Video::getVideoFromFileName and Video::getPathToFile, are the core components that enable this exploit. The entry point for the attack is the view/hls.php script, which calls these vulnerable functions.

Vulnerable functions

Video::getVideoFromFileName

objects/video.php

This function is part of the vulnerability because it incorrectly processes the input `fileName` by only using the first path segment before a `/`. This flaw is exploited to bypass the authorization check by providing a path that starts with a public video's directory.

Video::getPathToFile

objects/video.php

This function is vulnerable because it constructs a file path using the `videoFilename` parameter without properly sanitizing path traversal sequences (`..`). This allows an attacker to navigate the file system and access files outside of the intended directory, leading to the exposure of private content.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.