WWBN AVideo is an open source video platform. In versions up to and including 26.0, the "objects/pluginRunDatabaseScript.json.php" endpoint accepts a "name" parameter via POST and passes it to "Plugin::getDatabaseFileName()" without any path traversal sanitization. This allows an authenticated admin (or an attacker via CSRF) to traverse outside the plugin directory and execute the contents of any "install/install.sql" file on the filesystem as raw SQL queries against the application database. Commit 81b591c509835505cb9f298aa1162ac64c4152cb contains a patch.