CVE-2023-49738 is a high severity (CVSS 7.5) arbitrary file read in the image404Raw.php script of WWBN AVideo. A crafted request can read files from the server without logging in. Talos says the vendor patched it in December 2023 but names no version, so update and verify.
What's affected
The record names WWBN AVideo dev master commit 15fed957fb. The weakness is CWE-73 (external control of a file name or path). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: network reachable, no login, high confidentiality impact only.
Talos advisory TALOS-2023-1881 says the script view/img/image404Raw.php appends the image parameter to a root path and reads the result without validating it. That is the level of detail the advisory gives, and it is enough to explain the cause without describing an attack.
Fixed versions: the vendor was notified on 2023-12-14 and patched on 2023-12-15 per Talos. No release number is named, so confirm in the project history.
How to check if you're exposed
Check the AVideo commit date on your server as in the git commands below.
cd /path/to/AVideo
git log -1 --format=%H%n%cd
If your install predates 15 December 2023, update. Also review web server access logs for unusual requests to image404Raw.php, and consider what sensitive files live on the web host, such as configuration files with database credentials. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find every AVideo deployment and record its commit or release.
- Update to a build that postdates the December 2023 patch.
- Rotate secrets stored in files the web user can read, such as database and API credentials, if you ran a vulnerable build exposed to the internet.
- Review access logs for odd requests to the affected script.
- Restrict the web process so it can read only the files it needs.
Why it matters
A path control flaw lets a caller choose which file the server reads. Because the read needs no login, any visitor who can reach the site could request files the application never meant to serve.
The impact depends on what is readable. Config files, keys and backups turn a file read into a wider compromise, which is why rotating secrets belongs in the response. This CVE is not on the CISA KEV list.
Quick check
Is authentication required?
No. The vector shows no privileges and no user interaction.
Is there a named fixed version?
Talos names none, only a patch date of 2023-12-15. Verify your build against the repository.
Sources
Last reviewed: 19 October 2026.
