Is CVE-2026-33692 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33692 being exploited in the wild.

How severe is CVE-2026-33692?

High severity, with a CVSS score of 7.5, published 16 July 2026.

Which products and versions are affected?

wwbn/avideo (Packagist) < 29.0, ECOSYSTEM:introduced=0,fixed=29.0; WWBN AVideo < 29.0.

Is there a fix for CVE-2026-33692?

Yes. wwbn/avideo (Packagist): upgrade to 29.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33692 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33692?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33692: WWBN AVideo sensitive information disclosure in Docker configuration

Q: Is there a fix for CVE-2026-33692?

Yes. wwbn/avideo (Packagist): upgrade to 29.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33692 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-33692?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33692 · Severity: high · CVSS 7.5 · Published 2026-07-16

WWBN AVideo is an open-source video sharing platform. In versions prior to 29.0, a configuration error in the official Docker deployment files allows anyone on the internet to download the system's environment configuration file. This file contains sensitive information including database passwords and administrator credentials, which could allow an attacker to take full control of the video platform and its underlying data.

Technologies: wwbn/avideo (Packagist), WWBN AVideo. Vendors: Packagist, WWBN.

Quick answers

Is CVE-2026-33692 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33692 being exploited in the wild.
How severe is CVE-2026-33692?: High severity, with a CVSS score of 7.5, published 16 July 2026.
Which products and versions are affected?: wwbn/avideo (Packagist) < 29.0, ECOSYSTEM:introduced=0,fixed=29.0; WWBN AVideo < 29.0.
Is there a fix for CVE-2026-33692?: Yes. wwbn/avideo (Packagist): upgrade to 29.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33692 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33692?: Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

wwbn/avideo (Packagist): upgrade to 29.0 or later
```
composer require wwbn/avideo:^29.0
```

Technical details

WWBN AVideo prior to version 29.0 contains an information disclosure vulnerability stemming from its official Docker Compose configuration. The docker-compose.yml file mounts the entire project root directory as the Apache document root without restricting access to sensitive files. Because there were no .htaccess rules or Apache configurations to block access to dotfiles, the .env file—containing DB_MYSQL_PASSWORD, SYSTEM_ADMIN_PASSWORD, and network topology—is served as a static file at the /.env path. An unauthenticated remote attacker can retrieve this file via a simple GET request, leading to full administrative takeover and potential lateral movement within the Docker network. The issue is resolved in version 29.0 by adding a rewrite rule to .htaccess that denies access to hidden files.

Affected products

WWBN AVideo < 29.0

Identifiers

CVE-2026-33692
GHSA-wf69-r4mx-43rr

Timeline

2026-06-22: advisory: GitHub Security Advisory published
2026-07-16: disclosed: CVE published to NVD
2026-07-16: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.