CVE-2026-33513 Details

A vulnerability exists in WWBN AVideo versions through 26.0, where an unauthenticated API endpoint named 'locale' allows for local file inclusion. The endpoint concatenates user input into an include path without proper validation, enabling path traversal. This flaw can be exploited to include arbitrary PHP files under the web root, leading to unauthorized file disclosure and execution of the included PHP code. The vulnerability could escalate to remote code execution if an attacker can place or control a PHP file in a writable directory.

To address this vulnerability, implement input validation to reject path separators and dots, and enforce a strict allowlist of locale slugs. Use 'realpath' to verify that the target file remains within the allowed directory. Consider removing the use of 'include' for loading translations, and instead use vetted data formats like JSON or arrays. Adding authentication, such as an API secret or token, to the endpoint can also help mitigate the risk.