PT-2026-27185 · Avideo · Avideo

Restriction · Publicado 2026-03-23 · Atualizado 2026-03-25 · CVE-2026-33681

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The objects/pluginRunDatabaseScript.json.php API endpoint accepts a name parameter via POST and passes it to the Plugin::getDatabaseFileName() function without proper path traversal sanitization. This allows an authenticated administrator, or an attacker via Cross-Site Request Forgery (CSRF), to traverse outside the plugin directory and execute the contents of any install/install.sql file on the filesystem as raw SQL queries against the application database.

Recommendations Update to a version beyond 26.0.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-33681

GHSA-3HWV-X8G3-9QPR

Produtos afetados

Avideo

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33681.json · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/commit/81b591c509835505cb9f298aa1162ac64c4152cb · Correção
• https://github.com/WWBN/AVideo/security/advisories/GHSA-3hwv-x8g3-9qpr · Aviso do Fabricante
• https://twitter.com/vuldb/status/2036257496885756379 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33681 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33681 · Nota de Segurança
• https://github.com/advisories/GHSA-v8jw-8w5p-23g3 · Nota
• https://osv.dev/vulnerability/GHSA-3hwv-x8g3-9qpr · Aviso do Fabricante