AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
Date: 2026-03
Affected: composer/wwbn/avideo
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33292
CWE: CWE-22
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

## Summary The HLS streaming endpoint (`view/hls.php`) is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The `videoDirectory` GET parameter is used in two divergent code paths — one for authorization (which truncates at the first `/` segment) and one for file access (which preserves `..` traversal sequences) — creating a split-oracle condition where authorization is checked against one video while content is served from another. ## Details The vulnerability is a split-oracle between the authorization lookup and the filesystem path construction. When `hls.php` receives a request, it processes `$_GET['videoDirectory']` through two independent functions that interpret the input differently. **Step 1 — Authorization lookup truncates at first path segment** (`objects/video.php:1685-1688`): ```php public static function getVideoFromFileName($fileName, $ignoreGroup = false, $ignoreTags = false) { // ... $parts = explode("/", $fileName); if (!empty($parts[0])) { $fileName = $parts[0]; // Only takes first segment } $fileName = self::getCleanFilenameFromFile($fileName); // ... $sql = "SELECT id FROM videos WHERE filename = ? LIMIT 1"; $res = sqlDAL::readSql($sql, "s", [$fileName]); ``` For input `public_video/../private_video`, `explode("/", ...)` yields `["public_video", "..", "private_video"]` and only `public_video` is used for the DB query. The authoriz


Mitigations:

Architectural layers (MAESTRO):