Executive brief
Vedo Suite, a video management platform, contains a security flaw that allows logged-in users to access sensitive files on the underlying server. By exploiting this vulnerability, an attacker could read configuration files, system credentials, or other private data, potentially leading to a full system compromise. This issue stems from a failure to properly restrict file access within the video preview feature.
Technical details
A local file inclusion (LFI) vulnerability exists in Vedo Suite version 2024.17. The flaw is located in the '/api_vedo/video/preview' endpoint, where the application utilizes an unsanitized 'readfile()' function call. A remote attacker with low-level authentication can provide manipulated file paths to bypass intended directory restrictions. This allows for the unauthorized retrieval of arbitrary files from the server's filesystem, such as system configuration files or sensitive application data. The vulnerability is tracked as CWE-98.
Affected products
- Vedo Suite Project Vedo Suite 2024.17
Timeline
- 2025-08-06: disclosed
- 2025-08-06: advisory