CVE-2026-33692

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which contains database credentials, admin passwords, and infrastructure configuration — to be served as a static file at /.env. No .htaccess rule or Apache configuration blocks access to dotfiles. Exploitation enables direct database access, admin panel takeover, and further lateral movement within the Docker network. This issue has been resolved in version 29.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/WWBN/AVideo/commit/7f418de1a95ab87bb8c8c3eb3702d71c351e098d
https://github.com/WWBN/AVideo/security/advisories/GHSA-wf69-r4mx-43rr
https://github.com/WWBN/AVideo/security/advisories/GHSA-wf69-r4mx-43rr

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) WWBN AVideo es una plataforma de video de código abierto. Las versiones anteriores a la 29.0 exponen los archivos .env a usuarios no autenticados a través de la configuración oficial de Docker compose. El archivo oficial docker-compose.yml monta el directorio raíz completo del proyecto como la raíz de documentos de Apache, lo que provoca que el archivo .env - que contiene credenciales de base de datos, contraseñas de administrador y configuración de infraestructura - se sirva como un archivo estático en /.env. Ninguna regla .htaccess o configuración de Apache bloquea el acceso a los dotfiles. La explotación permite el acceso directo a la base de datos, la toma de control del panel de administración y un mayor movimiento lateral dentro de la red Docker. Este problema ha sido resuelto en la versión 29.0.

Information

Published : 2026-07-16 21:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-33692

Mitre link : CVE-2026-33692

CVE.ORG link : CVE-2026-33692

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-33692", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33692", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T13:22:51.308688Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "< 29.0"}]}]}], "published": "2026-07-16T21:17:20.183", "references": [{"url": "https://github.com/WWBN/AVideo/commit/7f418de1a95ab87bb8c8c3eb3702d71c351e098d", "source": "security-advisories@github.com"}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-wf69-r4mx-43rr", "source": "security-advisories@github.com"}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-wf69-r4mx-43rr", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file \u2014 which contains database credentials, admin passwords, and infrastructure configuration \u2014 to be served as a static file at /.env. No .htaccess rule or Apache configuration blocks access to dotfiles. Exploitation enables direct database access, admin panel takeover, and further lateral movement within the Docker network. This issue has been resolved in version 29.0."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. Las versiones anteriores a la 29.0 exponen los archivos .env a usuarios no autenticados a trav\u00e9s de la configuraci\u00f3n oficial de Docker compose. El archivo oficial docker-compose.yml monta el directorio ra\u00edz completo del proyecto como la ra\u00edz de documentos de Apache, lo que provoca que el archivo .env - que contiene credenciales de base de datos, contrase\u00f1as de administrador y configuraci\u00f3n de infraestructura - se sirva como un archivo est\u00e1tico en /.env. Ninguna regla .htaccess o configuraci\u00f3n de Apache bloquea el acceso a los dotfiles. La explotaci\u00f3n permite el acceso directo a la base de datos, la toma de control del panel de administraci\u00f3n y un mayor movimiento lateral dentro de la red Docker. Este problema ha sido resuelto en la versi\u00f3n 29.0."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "security-advisories@github.com"}