CVE-2026-33692High· 7.5▾ TwilightAVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.5%
CWE: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory
The official docker-compose.yml (line 61) mounts the entire project root directory as the Apache document root:
volumes:
- "./:/var/www/html/AVideo"
This causes the .env file — which contains database credentials, admin passwords, and infrastructure configuration — to be served as a static file at /.env. No .htaccess rule or Apache configuration blocks access to dotfiles.
An unauthenticated request to GET /.env returns:
DB_MYSQL_HOST=database
DB_MYSQL_USER=avideo
DB_MYSQL_PASSWORD=avideo
SYSTEM_ADMIN_PASSWORD=admin123
TLS_CERTIFICATE_FILE=/etc/apache2/ssl/localhost.crt
TLS_CERTIFICATE_KEY=/etc/apache2/ssl/localhost.key
NETWORK_SUBNET=172.30.0.0/16
docker-compose.ymldocker compose up -dcurl http://target/.env.env file contents are returned, including database credentials and admin passwordDB_MYSQL_USER, DB_MYSQL_PASSWORD), admin password (SYSTEM_ADMIN_PASSWORD), and internal network topology (NETWORK_SUBNET). This enables direct database access, admin panel takeover, and further lateral movement within the Docker network.Add a .htaccess rule to block access to dotfiles:
# Block access to hidden files (.env, .git, etc.)
<FilesMatch "^\.">
Order Allow,Deny
Deny from all
</FilesMatch>
Or configure Apache to deny dotfile access in the virtual host configuration.
wwbn/avideo < 29.0Upgrade to a patched release:
wwbn/avideo 29.0Connected by shared product, vendor, weakness, or advisory.
GHSA-xj9w-cgqg-q897Medium· 6.5Duplicate Advisory: AVideo has Unauthenticated PGP Message Decryption via Public Endpoint
CVE-2026-56346MediumAVideo has Unauthenticated PGP Message Decryption via Public Endpoint
GHSA-rg7q-4223-phjwHigh· 7.5Duplicate Advisory: AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
CVE-2026-56341High· 7.5AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
CVE-2026-33684Medium· 5.3AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions
CVE-2026-33731Medium· 6.5AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data