UpHeron
All vulnerabilities

Servers and applications

GHSA-58h3-9722-fgpm

AVideo ADs path traversal allows authenticated arbitrary file deletion

Severity
High 8.1
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Path traversal (CWE-22)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Sources
Project advisories (GitHub)

Description

plugin/ADs/deleteImage.json.php builds the deletion directory from the raw $_REQUEST['is_regular_user'] value without casting it or checking it against the caller's user id. A registered user granted "Can have custom ads" can (a) delete any other user's or the site-wide ads, and (b) supply ../ sequences to delete arbitrary files writable by the web server whose names match an alphanumeric pattern. For example, deleting videos/configuration.php takes the site offline and drops it back into the installer.

A low-privilege user (not an admin) with a feature permission crosses into (1) other users' content (deleting their ads and the admin's site-wide ads) and (2) the server filesystem: arbitrary deletion of web-server-writable files outside the ADs directory. Deleting videos/configuration.php causes a full site outage and re-exposes the installer.

From WWBN/AVideo's security advisory. Shortened; the full text is there.

Workarounds

The maintainer described a fix in the private discussion, but a public fix commit or patched release has not been verified. On 2026-11-11, public master still passed the raw request value to ADs::getAdsPath(). No patched version is claimed in this advisory.

Until a verified fix is available, disable the ADs plugin or revoke the "Can have custom ads" permission from untrusted users.

Workarounds as given by WWBN/AVideo's security advisory.

Affected software

SoftwareAffected versions
AVideoServers and applications · github:wwbn/avideo
  • From 12.4 up to 29.7.1

References