CVE-2026-33354 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, `POST /objects/aVideoEncoder.json.php` accepts a requester-controlled `chunkFile` parameter intended for staged upload chunks. Instead of restricting that path to trusted server-generated chunk locations, the endpoint accepts arbitrary local filesystem paths that pass `isValidURLOrPath()`. That helper allows files under broad server directories including `/var/www/`, the application root, cache, tmp, and `videos`, only rejecting `.php` files. For an authenticated uploader editing their own video, this becomes an arbitrary local file read. The endpoint copies the attacker-chosen local file into the attacker's public video storage path, after which it can be downloaded over HTTP. Commit 59bbd601a3f65a5b18c1d9e4eb11471c0a59214f contains a patch for the issue.
A vulnerability allowing authenticated users to read arbitrary local files has been identified in WWBN AVideo versions through 26.0. The issue arises in the `POST /objects/aVideoEncoder.json.php` endpoint, which accepts a user-controlled `chunkFile` parameter for uploading video chunks. Instead of limiting this parameter to safe, server-generated file locations, the endpoint allows access to a wide range of local filesystem paths that pass the `isValidURLOrPath()` validation. This includes directories like `/var/www/`, the application root, cache, temporary files, and the `videos` directory, while only excluding `.php` files. Exploiting this vulnerability involves injecting a path to a readable file, which is then copied to the user's public video storage, where it can be downloaded via HTTP.
Users can update to the latest version of WWBN AVideo, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/commit/59bbd601a3f65a5b18c1d9e4eb11471c0a59214f | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-4jw9-5hrc-m4j6 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | New CVE Received | [email protected] |