CVE-2022-30547: AVideo unzipDirectory path traversal leads to command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.9 with network reachability, low privileges, changed scope and high confidentiality, integrity and availability impact, plus a very high EPSS score and public exploit detail.

What it is

WWBN AVideo 11.6 and dev master commit 3f7c0364 contain a directory traversal flaw in the unzipDirectory functionality. A crafted HTTP request can escape the intended extraction path and result in arbitrary command execution. The flaw is critical because it turns a file-handling routine into remote code execution on the server.

Impact

An attacker with a low-privileged account can execute arbitrary commands on the host, leading to full compromise of the application and its data. Because the scope is changed, the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via an HTTP request to the unzipDirectory functionality; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N). No authentication bypass is implied, so a valid low-privileged session is needed.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.637, 99.2nd percentile) and the Talos reference is tagged Exploit, indicating public exploit detail exists.

What to do

• Apply the vendor fix or upgrade AVideo past the affected 11.6 / dev master commit 3f7c0364 state.
• Restrict access to the unzipDirectory functionality to trusted administrative roles only.
• Validate and canonicalize archive entry paths before extraction, rejecting entries that resolve outside the target directory.
• Run the AVideo service with least privilege and isolate it from sensitive host resources.
• Monitor and alert on unexpected child processes spawned by the web server.

Detection

• Review web server and application logs for requests to unzipDirectory endpoints with traversal sequences such as ../ in parameters.
• Alert on archive extraction events that write files outside expected upload or media directories.
• Monitor for unexpected process creation by the AVideo/PHP service account, especially shell or command interpreters.
• Correlate file writes in web-accessible paths with subsequent outbound or command execution activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.