Quick answers
- Is CVE-2026-46337 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-46337 being exploited in the wild.
- How severe is CVE-2026-46337?
- Medium severity, with a CVSS score of 3.1, published 29 May 2026.
- Which products and versions are affected?
- wwbn/avideo (Packagist) <= 29.0, ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0.
- Is there a fix for CVE-2026-46337?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-46337 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-46337?
- Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability exists in the `view/img/image404Raw.php` endpoint of WWBN AVideo. The script takes the `image` GET parameter and concatenates it directly into a filesystem path used by the `readfile()` function without proper sanitization or validation against the intended directory. While the application performs a `getimagesize()` check, this only verifies that the file's magic bytes match a known image format and does not prevent directory traversal. An unauthenticated attacker can use `..` sequences to access private profile photos, admin-uploaded thumbnails, or images in sibling directories on the server. As of the advisory date, no official patch has been released.
Affected products
- WWBN AVideo <= 29.0
Identifiers
- CVE-2026-46337
- GHSA-w4qq-74h6-58wq
Timeline
- 2026-05-12: other: Vulnerability discovered
- 2026-05-13: disclosed: Advisory published on GitHub
- 2026-05-29: advisory: CVE published in NVD