Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-33513: AVideo Open Source Video Platform: Unauthenticated File Access
CVE-2026-33513 · published 7 months ago
Summary
An open source video platform's API endpoint allows hackers to access and potentially execute any file on the server, potentially leading to data theft or unauthorized code execution. This affects versions up to 26.0. To protect your system, update to a patched version as soon as it becomes available or take immediate action to secure the server.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wwbn | avideo |
<= 26.0 cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* |
Original advisory text
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonic...
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., `view/about.php`), and it *can* escalate to RCE if an attacker can place or control a PHP file elsewhere in the tree. As of time of publication, no patched versions are available.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-22Path Traversal
CWE-98Improper Control of Filename for Include
Timeline
Published23 Mar 2026
Updated4 Nov 2026
First seen23 Mar 2026
Sources
CVE-2026-33513 · NVD
Track software like this
Free during beta