CVE-2026-33513 is a high-severity path traversal vulnerability in WWBN AVideo versions up to 26.0. An unauthenticated API endpoint improperly concatenates user input into an include path without validation, allowing attackers to traverse directories and include arbitrary PHP files within the web root. This can lead to file disclosure and limited code execution of existing PHP files. If an attacker can upload or control PHP files elsewhere in the directory tree, this vulnerability can escalate to full remote code execution (RCE). No patches are currently available, and exploitation requires no authentication or user interaction. The vulnerability poses significant risk to organizations using AVideo for video hosting and streaming, especially those with publicly accessible instances. Immediate mitigations include restricting access to the vulnerable API, implementing input validation, and monitoring for suspicious file access patterns.
CVE-2026-33512 is a high-severity improper authentication vulnerability in WWBN AVideo versions up to 26.0. The API plugin exposes a decryptString action without requiring authentication, allowing any user to submit ciphertext and receive the corresponding plaintext. Since ciphertext tokens are publicly accessible via endpoints like view/url2Embed.json.php, attackers can decrypt protected tokens and metadata. This flaw compromises confidentiality but does not affect integrity or availability. A patch has been committed to fix this issue. No known exploits are currently reported in the wild. Organizations using affected versions should update promptly to prevent unauthorized data exposure.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php` endpoint allows admin users to upload and install plugin ZIP files containing executable PHP code, but lacks any CSRF protection. Combined with the application explicitly setting `session.cookie_samesite = 'None'` for HTTPS connections, an unauthenticated attacker can craft a page that, when visited by an authenticated admin, silently uploads a malicious plugin containing a PHP webshell, achieving Remote Code Execution on the server. Commit d1bc1695edd9ad4468a48cea0df6cd943a2635f3 contains a patch.
CVE-2026-33502 is a critical Server-Side Request Forgery (SSRF) vulnerability in WWBN AVideo versions up to 26.0. It allows unauthenticated remote attackers to make the server send arbitrary HTTP requests via the vulnerable plugin/Live/test.php endpoint. This can be exploited to access internal network services, including localhost and cloud metadata endpoints, potentially exposing sensitive data. The vulnerability has a CVSS score of 9.3, indicating high impact on confidentiality with no authentication or user interaction required. A patch has been committed to fix this issue. Organizations running affected versions of AVideo should prioritize updating to the patched version to mitigate risk. No known exploits are currently reported in the wild, but the ease of exploitation and potential impact make this a critical threat to video platform deployments.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint `plugin/Permissions/View/Users_groups_permissions/list.json.php` lacks any authentication or authorization check, allowing unauthenticated users to retrieve the complete permission matrix mapping user groups to plugins. All sibling endpoints in the same directory (`add.json.php`, `delete.json.php`, `index.php`) properly require `User::isAdmin()`, indicating this is an oversight. Commits dc3c825734628bb32550d0daa125f05bacb6829c and b583acdc9a9d1eab461543caa363e1a104fb4516 contain patches.
CVE-2026-33500 is a stored cross-site scripting (XSS) vulnerability in WWBN AVideo versions up to 26.0. The issue arises from improper sanitization of markdown links in user comments, allowing attackers to inject malicious JavaScript via markdown link syntax. This bypasses the custom sanitization implemented for raw HTML tags because the markdown parser disables safeMode, which normally filters unsafe URLs. Exploitation requires low privileges and user interaction but can lead to confidentiality and integrity impacts by executing arbitrary scripts in other users' browsers. A patch addressing this vulnerability has been committed but not yet widely deployed. Organizations using affected versions should apply the patch promptly and review comment sanitization controls. The CVSS score is 5.4 (medium severity).
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST['unlockPassword']` parameter directly into an HTML `<input>` tag's attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. Commit f154167251c9cf183ce09cd018d07e9352310457 contains a patch.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/import.json.php` endpoint accepts a user-controlled `fileURI` POST parameter with only a regex check that the value ends in `.mp4`. Unlike `objects/listFiles.json.php`, which was hardened with a `realpath()` + directory prefix check to restrict paths to the `videos/` directory, `import.json.php` performs no directory restriction. This allows an authenticated user with upload permission to: (1) steal any other user's private video files by importing them into their own account, (2) read `.txt`/`.html`/`.htm` files adjacent to any `.mp4` file on the filesystem, and (3) delete `.mp4` and adjacent text files if writable by the web server process. Commit e110ff542acdd7e3b81bdd02b8402b9f6a61ad78 contains a patch.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's `_session_start()` function accepts arbitrary session IDs via the `PHPSESSID` GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in `User::login()`, this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch.
CVE-2026-33488 is a high-severity vulnerability in WWBN AVideo versions up to 26.0, where the LoginControl plugin's PGP 2FA system uses weak 512-bit RSA keys. These keys can be factored on commodity hardware within hours, allowing attackers to derive private keys and bypass the second authentication factor by decrypting PGP challenges. Additionally, two endpoints related to key generation and encryption lack authentication, exposing the system to resource exhaustion attacks by anonymous users. Although no exploits are currently known in the wild, the vulnerability poses a significant risk to confidentiality and integrity of user authentication. A patch has been committed to address the issue. Organizations using affected versions should urgently upgrade and restrict access to vulnerable endpoints to mitigate exploitation risks.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `plugin/Live/on_publish.php` is accessible without authentication. The `$_POST['name']` parameter (stream key) is interpolated directly into SQL queries in two locations — `LiveTransmitionHistory::getLatest()` and `LiveTransmition::keyExists()` — without parameterized binding or escaping. An unauthenticated attacker can exploit time-based blind SQL injection to extract all database contents including user password hashes, email addresses, and other sensitive data. Commit af59eade82de645b20183cc3d74467a7eac76549 contains a patch.
CVE-2026-33483 is a high-severity vulnerability in WWBN AVideo versions up to 26.0 involving an unauthenticated PHP endpoint that allows remote attackers to write unlimited data to temporary files without size or rate limits. This flaw enables trivial disk space exhaustion, resulting in denial of service (DoS) of the entire server hosting the video platform. The vulnerable endpoint, aVideoEncoderChunk.json.php, lacks authentication, framework protections, and cleanup mechanisms, making exploitation straightforward. No user interaction or privileges are required, and the attack surface is fully remote. A patch addressing this issue is available in commit 33d1bae6c731ef1682fcdc47b428313be073a5d1. Organizations using affected versions should prioritize applying the patch to prevent service disruption. The vulnerability impacts confidentiality and integrity minimally but severely affects availability.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&&`, `;`, `|`, `` ` ``, `<`, `>`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`). The unauthenticated `plugin/LiveLinks/proxy.php` endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost services. Commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373 contains a patch.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Gallery plugin's `saveSort.json.php` endpoint passes unsanitized user input from `$_REQUEST['sections']` array values directly into PHP's `eval()` function. While the endpoint is gated behind `User::isAdmin()`, it has no CSRF token validation. Combined with AVideo's explicit `SameSite=None` session cookie configuration, an attacker can exploit this via cross-site request forgery to achieve unauthenticated remote code execution — requiring only that an admin visits an attacker-controlled page. Commit 087dab8841f8bdb54be184105ef19b47c5698fcb contains a patch.
CVE-2026-33478 is a critical remote code execution vulnerability in WWBN AVideo versions up to 26.0. It involves a chain of flaws in the CloneSite plugin that allows unauthenticated attackers to access secret keys, dump the database including weakly hashed admin passwords, and ultimately execute arbitrary OS commands via an injection in the rsync command. The vulnerability requires no authentication or user interaction and affects confidentiality, integrity, and availability severely. A patch is available in commit c85d076375fab095a14170df7ddb27058134d38c. Organizations using AVideo should urgently update to a fixed version to prevent exploitation. The CVSS score is 10.0, reflecting the critical nature of this flaw.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, `POST /objects/aVideoEncoder.json.php` accepts a requester-controlled `chunkFile` parameter intended for staged upload chunks. Instead of restricting that path to trusted server-generated chunk locations, the endpoint accepts arbitrary local filesystem paths that pass `isValidURLOrPath()`. That helper allows files under broad server directories including `/var/www/`, the application root, cache, tmp, and `videos`, only rejecting `.php` files. For an authenticated uploader editing their own video, this becomes an arbitrary local file read. The endpoint copies the attacker-chosen local file into the attacker's public video storage path, after which it can be downloaded over HTTP. Commit 59bbd601a3f65a5b18c1d9e4eb11471c0a59214f contains a patch for the issue.
CVE-2026-33352 is a critical SQL injection vulnerability in WWBN AVideo versions prior to 26.0. It exists in the getAllCategories() method within objects/category.php, where the doNotShowCats parameter is improperly sanitized by only removing single quotes, allowing bypass via backslash escaping. This flaw permits unauthenticated attackers to execute arbitrary SQL commands, potentially leading to full database compromise including data disclosure, modification, or deletion. The vulnerability has a CVSS score of 9.8, reflecting its critical impact and ease of exploitation without authentication or user interaction. Although no known exploits are currently reported in the wild, affected organizations should urgently apply the patch introduced in version 26.0. The threat primarily impacts deployments of WWBN AVideo, an open-source video platform, which is used globally but more prevalent in countries with significant open-source adoption and video content platforms.
WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Live/standAloneFiles/saveDVR.json.php`. When the AVideo Live plugin is deployed in standalone mode (the intended configuration for this file), the `$_REQUEST['webSiteRootURL']` parameter is used directly to construct a URL that is fetched server-side via `file_get_contents()`. No authentication, origin validation, or URL allowlisting is performed. Version 26.0 contains a patch for the issue.
WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before being stored. This means that regardless of the intended password, the stored channel password becomes 0, which any visitor can trivially guess to bypass channel-level access control. Version 26.0 contains a patch for the issue.