AVideo 存在 HLS 端点中的路径遍历绕过授权漏洞，允许流式传输私有/付费视频

攻击者可以利用此路径遍历漏洞绕过身份验证机制，访问并流式传输平台上的任何私有或付费视频内容。这可能导致未经授权的访问敏感信息，造成经济损失，损害声誉，甚至可能导致数据泄露。由于该漏洞无需身份验证，攻击者可以轻松利用它，影响范围广泛。该漏洞的本质类似于其他路径遍历漏洞，攻击者可以通过构造恶意的 videoDirectory 参数来访问任意文件。

Organizations utilizing wwbn/avideo for video streaming, particularly those with private or paid content, are at risk. Shared hosting environments where multiple users share the same instance of wwbn/avideo are especially vulnerable, as an attacker could potentially exploit this vulnerability to access content belonging to other users.

• php: Examine access logs for requests containing .. sequences in the videoDirectory parameter of the view/hls.php endpoint. • php: Search for code patterns related to divergent path handling of the videoDirectory parameter, specifically where one path truncates at / and another preserves .. sequences. • generic web: Use curl to test for path traversal by appending ../ sequences to the videoDirectory parameter and observing the response.

curl 'http://your-avideo-instance/view/hls.php?videoDirectory=../../../../etc/passwd'

1. 2026-03-19Disclosure

   disclosure

1. 已保留2026-03-18
2. 发布日期2026-03-19
3. 修改日期2026-03-25
4. EPSS 更新日期2026-03-30

最有效的缓解措施是升级到 wwbn/avideo 26.0 版本或更高版本，该版本修复了此漏洞。如果无法立即升级，则可以考虑以下临时缓解措施：严格限制对 view/hls.php 端点的访问，仅允许授权用户访问。实施输入验证，确保 videoDirectory 参数不包含 .. 序列。配置 Web 应用防火墙 (WAF) 以阻止包含路径遍历模式的请求。定期审查和更新安全配置。