WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for "objects/aVideoEncoderReceiveImage.json.php" only checks the URL path component (via "parse_url($url, PHP_URL_PATH)") for ".." sequences. However, the downstream function "try_get_contents_from_local()" in "objects/functionsFile.php" uses "explode('/videos/', $url)" on the full URL string including the query string. An attacker can place the "/videos/../../" traversal payload in the query string to bypass the security check and read arbitrary files from the server filesystem. Commit bd11c16ec894698e54e2cdae25026c61ad1ed441 contains an updated fix.