CyberRota Analysis
AI-GeneratedVersions of WWBN AVideo prior to 29.0 are vulnerable due to improper configuration in the Docker compose setup, which exposes sensitive .env files to unauthenticated users. This flaw allows attackers to access critical information such as database credentials and admin passwords, potentially leading to database compromise and unauthorized access to the admin panel. Organizations using affected versions should prioritize patching to version 29.0 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which contains database credentials, admin passwords, and infrastructure configuration — to be served as a static file at /.env. No .htaccess rule or Apache configuration blocks access to dotfiles. Exploitation enables direct database access, admin panel takeover, and further lateral movement within the Docker network. This issue has been resolved in version 29.0.