CVE-2025-48732 is a high severity flaw (CVSS 7.3) in WWBN AVideo 14.4 and dev master commit 8a8954ff. The sample .htaccess file has an incomplete blacklist, so a request for a .phar file can lead to code execution. The record names no fixed version, so check the Talos advisory and the project.
What's affected
The CVE record lists WWBN AVideo 14.4 and the development master commit 8a8954ff. The problem is in the sample .htaccess file that ships with the project. Its list of blocked file types is incomplete, and the record says an attacker can request a .phar file to trigger the flaw.
The record's only reference is a Talos Intelligence report (TALOS-2025-2213). That page was not available to me when I reviewed this post, so I could not confirm fixed versions or extra mitigations from it. Check the report and the AVideo project's release notes for a fixed release before you decide your next step.
If you copied the sample .htaccess into your own installation, your copy has the same list unless you have changed it.
How to check if you're exposed
Find your AVideo version in the admin area, and compare it with 14.4. Then look at the .htaccess file in the web root and in any folder that stores user uploads:
grep -rn "phar" /var/www/html/.htaccess
Adjust the path to your install. If the blocked extensions list does not include .phar and your web server runs PHP for that type, review the setup. You can also check whether the web server maps the .phar extension to the PHP handler in its own configuration:
grep -rn "phar" /etc/apache2/ /etc/php/ 2>/dev/null
Find files with that extension under the web root, which should be rare on a video platform:
find /var/www -name "*.phar" 2>/dev/null
Review access logs for requests that end in .phar.
What to do now
- Identify every AVideo instance and the version it runs.
- Check the Talos report and the project releases for a fixed version, and update when there is one.
- Add .phar to the blocked extensions in your .htaccess, and stop the web server from running that extension as PHP.
- Prevent script execution in upload and media directories through the web server configuration.
- Remove unexpected .phar files after you have preserved them for review, and rotate credentials if you suspect abuse.
Why it matters
The record lists the weakness as CWE-184, incomplete list of disallowed inputs. Block lists try to name everything dangerous, and attackers only need one item that is missing. PHP can run several file extensions, so a block list that names some of them and forgets another leaves a gap.
An allow list works the other way round. It names the few file types the application should serve, such as video and image formats, and refuses everything else. That design fails safe when a new dangerous type shows up.
The record shows low impact scores on each of confidentiality, integrity and availability, yet the description speaks of arbitrary code execution. Treat the code execution statement as the one to plan for. The issue is not in the CISA Known Exploited Vulnerabilities catalogue.
Quick check
Is there a patched AVideo release?
The record does not name one. Check the Talos report and the AVideo release notes, and apply the .phar block while you wait.
Does editing .htaccess fully fix the problem?
It closes the gap named in the record. Also stop the web server from executing uploads, and prefer an allow list over a block list.
Sources
- Gold page for CVE-2025-48732
- Talos report TALOS-2025-2213, referenced by the record (not retrievable at review time)
Last reviewed: 18 October 2026.
