CVE-2026-33681: 
PHP vulnerability analysis and mitigation

CVE-2026-33681 is a path traversal vulnerability in WWBN AVideo, an open source video platform, affecting versions up to and including 26.0. The objects/pluginRunDatabaseScript.json.php endpoint accepts a name parameter via POST and passes it to Plugin::getDatabaseFileName() without any path traversal sanitization, allowing traversal outside the plugin directory and execution of arbitrary install/install.sql files as raw SQL queries against the application database. The vulnerability was published on March 23, 2026, with a patch committed on March 25, 2026. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, AVideo Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), stemming from an ineffective sanitization function AVideoPlugin::fixName() that only remaps the string 'Programs' to 'PlayLists' and returns all other input unchanged. The unsanitized name parameter is used to construct a filesystem path ({root}/plugin/{name}/install/install.sql), allowing ../ sequences to traverse outside the plugin directory. The sibling endpoint pluginRunUpdateScript.json.php correctly applies preg_replace('/[^0-9a-z_]/i', '', $name) via AVideoPlugin::loadPlugin(), but the vulnerable endpoint bypasses this entirely. Additionally, the endpoint lacks CSRF token validation (unlike pluginImport.json.php which checks isGlobalTokenValid()), enabling exploitation via CSRF against an authenticated admin without requiring direct credentials. SQL execution errors also leak raw file contents and MySQL error messages in HTTP responses, creating a secondary information disclosure vector (AVideo Advisory).

Successful exploitation allows an authenticated admin or a CSRF attacker to execute arbitrary SQL queries from any install/install.sql file reachable on the filesystem, potentially creating rogue admin accounts, modifying or deleting application data, or extracting sensitive information from the database. SQL execution errors expose raw file contents and MySQL error messages in HTTP responses, constituting a significant information disclosure risk. When chained with a file-write primitive (such as GHSA-v8jw-8w5p-23g3, the plugin ZIP extraction RCE), an attacker could write a malicious install.sql and then execute it via this endpoint, escalating to broader system compromise (AVideo Advisory).

A proof-of-concept exploit with concrete, reproducible attack steps (including specific curl commands and a CSRF HTML payload) is publicly available in the GitHub security advisory (AVideo Advisory). Exploitation requires either authenticated admin access or the ability to perform CSRF against an admin session; no in-the-wild exploitation has been observed as of the time of reporting. The EPSS score is approximately 0.113% (29th percentile), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing WWBN AVideo instances running version 26.0 or earlier using search engines (Shodan, Censys) or by checking the AVideo version disclosure in page source or API responses.
2. Obtain admin session (or prepare CSRF): Either authenticate as an admin user to obtain a valid PHPSESSID cookie, or prepare a CSRF HTML page to be served to a logged-in admin.
3. Direct exploitation (as admin): Send a crafted POST request to the vulnerable endpoint with a path-traversal name parameter:

curl -s -b "PHPSESSID=<admin_session>" \
  -d "name=../plugin/LiveLinks" \
  "https://target.com/objects/pluginRunDatabaseScript.json.php"

This resolves to {root}/plugin/../plugin/LiveLinks/install/install.sql and executes its SQL against the database. 4. CSRF exploitation (no direct admin access): Host an HTML page with a hidden form targeting the vulnerable endpoint and trick an admin into visiting it:

<form id="csrf" method="POST" action="https://target.com/objects/pluginRunDatabaseScript.json.php">
  <input type="hidden" name="name" value="../plugin/LiveLinks">
</form>
<script>document.getElementById('csrf').submit();</script>

5. Information disclosure via errors: If the traversed SQL file contains invalid SQL, observe the raw file content and MySQL error messages leaked in the JSON error response: {"error":true,"msg":"Error performing query 'FILE CONTENT HERE': MySQL error..."}
6. Escalation (optional chaining): If a file-write primitive is available (e.g., GHSA-v8jw-8w5p-23g3), write a malicious install.sql to a reachable path, then execute it via this endpoint to achieve arbitrary SQL execution or admin account creation (AVideo Advisory).

• Network: Unexpected POST requests to /objects/pluginRunDatabaseScript.json.php containing name parameter values with ../ path traversal sequences; requests originating from unusual IP addresses or referrers.
• Logs: Web server access logs showing POST requests to pluginRunDatabaseScript.json.php with name values containing directory traversal characters (e.g., ../); JSON error responses in server logs containing raw SQL file content or MySQL error messages.
• Database: Unexpected new admin accounts or modified user records; unusual database schema changes or new tables not associated with legitimate plugin installations; execution of SQL statements from non-standard plugin paths.
• File System: Presence of unexpected or modified install/install.sql files in plugin directories, particularly in locations outside the standard plugin folder structure (AVideo Advisory).

The patch is available in commit 81b591c509835505cb9f298aa1162ac64c4152cb, which adds preg_replace('/[^0-9a-z_]/i', '', $pluginName) sanitization inside Plugin::getDatabaseFileName() and adds a globalToken CSRF check to the AJAX request in pluginRunDatabaseScript.json.php (Patch Commit). Administrators should upgrade to a version of AVideo that includes this commit immediately. As a temporary workaround, restrict access to the /objects/pluginRunDatabaseScript.json.php endpoint via web server configuration (e.g., IP allowlisting), enforce CSRF protections at the application or WAF level, and limit admin account access to trusted networks (AVideo Advisory).

The vulnerability was reported by researcher DanielnetoDotCom and published via the GitHub Security Advisory program on March 23, 2026. Brief community discussion was noted on Bluesky and Infosec.exchange (VulDB), with the advisory also indexed by GitLab's advisory database. No major media coverage or significant vendor statements beyond the GitHub advisory have been identified (AVideo Advisory).