CVE-2026-33717 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote content to a web-accessible temporary directory using the original URL's filename and extension (including `.php`). By providing an invalid `resolution` parameter, an attacker triggers an early `die()` via `forbiddenPage()` before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at `videos/cache/tmpFile/`. Commit 6da79b43484099a0b660d1544a63c07b633ed3a2 contains a patch.
A remote code execution vulnerability exists in WWBN AVideo versions 26.0 and prior. The issue arises in the 'downloadVideoFromDownloadURL()' function within 'objects/aVideoEncoder.json.php', where remote content is saved to a publicly accessible temporary directory. The vulnerability is exploited by sending an invalid 'resolution' parameter, which triggers an early termination of the function before the temporary file can be moved or deleted. This oversight leaves a PHP file, capable of execution, accessible under the web root at 'videos/cache/tmpFile/'.
Users are advised to update to the patched version available in the GitHub repository. The latest version includes validation for the 'resolution' parameter and checks file extensions against an allowed list before downloading.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | New CVE Received | [email protected] |