PT-2026-22993 · Avideo · Avideo

Arkmarta · Published 2026-03-02 · Updated 2026-03-16 · CVE-2026-28502

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 24.0

Description AVideo is an open source video platform. A Remote Code Execution (RCE) issue was identified in the plugin upload/import functionality. An authenticated administrator could upload a specially crafted ZIP archive containing executable server-side files. Insufficient validation of extracted file contents allowed the archive to be extracted directly into a web-accessible plugin directory, enabling arbitrary PHP code execution. The issue allows for full system compromise, including confidentiality, integrity, and availability impact. The system validated only the ZIP extension of uploaded plugin packages but did not enforce a strict allowlist of file types within the archive. Extracted files were placed directly in a web-accessible directory without preventing execution of server-side scripts.

Recommendations Upgrade to AVideo version 24.0 or later. Disable plugin upload/import functionality. Configure the web server to prevent execution of PHP files inside plugin upload directories.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-28502

GHSA-V8JW-8W5P-23G3

Affected Products

Avideo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28502.json · Exploit
• https://github.com/WWBN/AVideo/commit/b739aeeb9ce34aed9961d2c155d597810f8229db · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-v8jw-8w5p-23g3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28502 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28502 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v8jw-8w5p-23g3 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/releases/tag/24.0 · Note
• https://twitter.com/cyberbivash/status/2029786085706891556 · Twitter Post
• https://t.me/cveNotify/155506 · Telegram Post