CVE-2026-33647 Details

A remote code execution vulnerability exists in WWBN AVideo versions through 26.0, within the ImageGallery plugin. The issue arises in the saveFile() method, where uploaded files are validated using MIME type detection. However, the method improperly derives the filename extension from the user-supplied original filename without an allowlist check. This flaw allows an attacker to upload a polyglot file containing valid JPEG magic bytes followed by PHP code, with a .php extension. While the MIME type check is passed, the file is saved as an executable .php file in a web-accessible directory, enabling remote code execution.

Users are advised to update to the patched version of AVideo, which includes a fix for this vulnerability. The recommended fix involves adding an extension allowlist check in the saveFile() method of the ImageGallery plugin, immediately after extracting the file extension from the user-supplied filename. The extension should be validated against the same set of types as the MIME allowlist. Additionally, as a defense-in-depth measure, users should add a .htaccess file to the videos directory to disable PHP execution.