| Package | Affected versions | Patched versions |
|---|---|---|
| bigbluebutton | = 2.6.0≤ 2.5.18 |
BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with a valid starting folder path, to traverse and read other files without authentication, assuming the files have certain extensions (txt, swf, svg, png). In version 2.6.0-beta.1, input validation was added on the parameters being passed and dangerous characters are stripped. There are no known workarounds.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free