CVE-2026-33692

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0

Description AVideo exposes sensitive .env files to unauthenticated users when deployed using the official Docker compose configuration. The docker-compose.yml file mounts the entire project root directory as the Apache document root, allowing the .env file to be served as a static file at the /.env endpoint. This file contains critical information, including database credentials, admin passwords, and infrastructure configuration. The lack of .htaccess rules or Apache configurations to block access to dotfiles enables remote attackers to obtain the DB MYSQL USER, DB MYSQL PASSWORD, SYSTEM ADMIN PASSWORD, and NETWORK SUBNET variables. This can lead to direct database access, admin panel takeover, and lateral movement within the Docker network.

Recommendations Update to version 29.0. As a temporary mitigation, add a .htaccess rule to block access to dotfiles or configure Apache to deny dotfile access in the virtual host configuration.