6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45731

CVE-2026-45731: WWBN AVideo: Authenticated Arbitrary File Read in view/update.php

WWBN AVideo is an open source video platform. In 29.0 and earlier, view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45731

CVE-2026-45731:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
WWBN/AVideo	composer	<= 29.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-3mjv-375j-6h92, is a path traversal flaw in the AVideo platform. The issue resides in the view/update.php script, which is responsible for handling database updates. According to the vulnerability description, the script takes a filename from the $_POST['updateFile'] parameter and directly concatenates it into a file path. This path is then used in a call to PHP's file() function to read the specified update script.

The root cause of the vulnerability is the lack of input sanitization on the $_POST['updateFile'] parameter. An authenticated administrator can exploit this by supplying a path with directory traversal sequences (e.g., ../). This allows them to read arbitrary files on the server that are accessible to the web server process, leading to information disclosure.

The vulnerable code is not contained within a specific function but rather in the global scope of the view/update.php script. During exploitation, a runtime profiler would indicate execution within this script, with a call to the file() function using a malicious, user-controlled path. The analysis of the master branch of the repository shows that a fix has been implemented by validating the $_POST['updateFile'] parameter against an allow-list of expected update files before passing it to the file() function. However, the advisory notes that there is no official patched version released yet.

Vulnerable functions

view/update.php

view/update.php

The script `view/update.php` directly uses the `$_POST['updateFile']` parameter to construct a file path that is passed to the `file()` function. There is no sanitization or validation of the user-provided input, which allows for path traversal attacks. An authenticated administrator can provide a malicious path like `../../../../etc/passwd` to read arbitrary files on the server's filesystem.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.