CVE-2026-33692CWE-20

AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration

High · published July 16, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which contains database credentials, admin passwords, and infrastructure configuration — to be served as a static file at /.env. No .htaccess rule or Apache configuration blocks access to dotfiles. Exploitation enables direct database access, admin panel takeover, and further lateral movement within the Docker network. This issue has been resolved in version 29.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-07-16T20:27Z
EPSS history
Timeline
  • 16 JUL 20:27Z
    AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration
    cvelistv5