PT-2026-26491 · Avideo · Avideo

Gr00Ve3 · Publicado 2026-03-19 · Atualizado 2026-03-23 · CVE-2026-33354

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description The POST /objects/aVideoEncoder.json.php endpoint in AVideo allows a requester-controlled chunkFile parameter to specify arbitrary local filesystem paths. The isValidURLOrPath() helper function does not sufficiently restrict these paths, allowing access to files within broad server directories, including /var/www/, the application root, cache, tmp, and videos, excluding only .php files. An authenticated uploader can leverage this to read arbitrary local files, which are then copied into their public video storage and accessible via HTTP. The issue was observed by successfully retrieving a TLS private key from /var/www/html/AVideo/.compose/letsencrypt/live/localhost/privkey.pem.

Recommendations Versions prior to 26.0 should be updated. As a temporary workaround, restrict access to the aVideoEncoder.json.php endpoint or the chunkFile parameter until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-73

Identificadores relacionados

CVE-2026-33354

GHSA-4JW9-5HRC-M4J6

Produtos afetados

Avideo

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33354.json · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/commit/59bbd601a3f65a5b18c1d9e4eb11471c0a59214f · Correção
• https://github.com/WWBN/AVideo/security/advisories/GHSA-4jw9-5hrc-m4j6 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-4jw9-5hrc-m4j6 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2036224373451829488 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1ryvfc9/resumen_diario_de_vulnerabilidades_20032026 · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33354 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33354 · Aviso do Fabricante