# CVE-2026-41062

> Vulnerability · severity: **MEDIUM** (CVSS 6.5).

## Description

WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceiveImage.json.php` only checks the URL path component (via `parse_url($url, PHP_URL_PATH)`) for `..` sequences. However, the downstream function `try_get_contents_from_local()` in `objects/functionsFile.php` uses `explode('/videos/', $url)` on the **full URL string** including the query string. An attacker can place the `/videos/../../` traversal payload in the query string to bypass the security check and read arbitrary files from the server filesystem. Commit bd11c16ec894698e54e2cdae25026c61ad1ed441 contains an updated fix.

## Key facts

- **CVE ID:** CVE-2026-41062
- **Published:** 2026-04-21
- **CVSS severity:** MEDIUM
- **CVSS base score:** 6.5
- **CWE codes:** CWE-22

## Affected products

- `wwbn:avideo`

## Primary sources

- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41062

## Citation

> AI Analytics. CVE-2026-41062. Retrieved 2026-09-01 from https://api.ai-analytics.org/cve/CVE-2026-41062. Derived from NIST NVD. Licensed CC0.

---

*[Dataset catalog](https://api.ai-analytics.org/datasets/) · [AI Analytics](https://api.ai-analytics.org/) · CC0 1.0*