Description

WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-01T23:17:21.947Z",
  "pubdate": "2026-09-01T23:17:21.947Z",
  "executiveSummary": "WWBN AVideo is susceptible to a path traversal vulnerability located within the get_api_login_code API endpoint. This flaw allows unauthenticated remote attackers to manipulate file system operations, specifically targeting the deletion of arbitrary .log files on the host server.\nThe vulnerability arises from insufficient input validation of the 'code' parameter, which fails to sanitize directory traversal sequences. By injecting crafted payloads, an attacker can escape the intended directory scope to target sensitive log files.\nThe primary security impact includes the systematic destruction of audit trails, which hinders forensic analysis and incident response efforts, and the potential for information disclosure regarding server file structure through file existence probing. Given that the endpoint requires no authentication, the attack surface is exposed to any remote user with network access to the AVideo instance. This poses a significant risk to system integrity and compliance, as the ability to delete logs effectively masks malicious activities and compromises the reliability of server-side monitoring mechanisms.",
  "technicalDetails": "The vulnerability is a classic path traversal flaw residing in the get_api_login_code endpoint of the WWBN AVideo application. The root cause is the improper handling of user-supplied input provided via the 'code' parameter, which is passed directly to file system operations without adequate sanitization or normalization. The application fails to validate the input against an allowed path list or strip dangerous traversal sequences, such as '../'.\nAn unauthenticated attacker can exploit this by crafting a malicious HTTP request targeting the affected API endpoint. By embedding directory traversal sequences into the 'code' parameter, an attacker can redirect the application's file deletion logic to reference files outside the designated operational directory. The internal processing of this endpoint effectively resolves the manipulated path, granting the attacker the ability to execute a delete operation on any file with a .log extension within the filesystem permissions context of the web server process.\nThe attack flow follows a predictable sequence: First, the attacker identifies the target endpoint, /get_api_login_code. Second, the attacker constructs a payload where the 'code' parameter contains sequences like '../../../../var/log/sensitive_log.log'. Third, the server, acting under the authority of the web service account, interprets the path as a legitimate instruction to locate and remove the specified log file. This process facilitates two distinct forms of impact: First, destructive action, where the removal of log files disrupts audit logs and obfuscates subsequent unauthorized activities. Second, side-channel information disclosure, where the attacker can leverage the application's response or state changes to confirm the existence of specific files on the underlying system, aiding in further reconnaissance and system fingerprinting.\nBecause the endpoint does not enforce authentication, the attack can be launched globally across any network segment with access to the API. The post-exploitation impact is characterized by the loss of audit integrity, which is critical for security auditing, and the potential mapping of the server directory structure by observing successful versus unsuccessful deletion attempts."
}