Executive brief
WWBN AVideo is an open-source video sharing platform. In versions prior to 29.0, a configuration error in the official Docker deployment files allows anyone on the internet to download the system's environment configuration file. This file contains sensitive information including database passwords and administrator credentials, which could allow an attacker to take full control of the video platform and its underlying data.
Technical details
WWBN AVideo prior to version 29.0 contains an information disclosure vulnerability stemming from its official Docker Compose configuration. The docker-compose.yml file mounts the entire project root directory as the Apache document root without restricting access to sensitive files. Because there were no .htaccess rules or Apache configurations to block access to dotfiles, the .env file—containing DB_MYSQL_PASSWORD, SYSTEM_ADMIN_PASSWORD, and network topology—is served as a static file at the /.env path. An unauthenticated remote attacker can retrieve this file via a simple GET request, leading to full administrative takeover and potential lateral movement within the Docker network. The issue is resolved in version 29.0 by adding a rewrite rule to .htaccess that denies access to hidden files.
Affected products
- WWBN AVideo < 29.0
Timeline
- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD
- 2026-07-16: patched: Fix committed to repository