PT-2026-26491 · Avideo · Avideo

Gr00Ve3 · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-33354

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description The POST /objects/aVideoEncoder.json.php endpoint in AVideo allows a requester-controlled chunkFile parameter to specify arbitrary local filesystem paths. The isValidURLOrPath() helper function does not sufficiently restrict these paths, allowing access to files within broad server directories, including /var/www/, the application root, cache, tmp, and videos, excluding only .php files. An authenticated uploader can leverage this to read arbitrary local files, which are then copied into their public video storage and accessible via HTTP. The issue was observed by successfully retrieving a TLS private key from /var/www/html/AVideo/.compose/letsencrypt/live/localhost/privkey.pem.

Recommendations Versions prior to 26.0 should be updated. As a temporary workaround, restrict access to the aVideoEncoder.json.php endpoint or the chunkFile parameter until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2026-33354

GHSA-4JW9-5HRC-M4J6

Affected Products

Avideo

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33354.json · Exploit
• https://github.com/WWBN/AVideo/commit/59bbd601a3f65a5b18c1d9e4eb11471c0a59214f · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-4jw9-5hrc-m4j6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33354 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33354 · Security Note
• https://osv.dev/vulnerability/GHSA-4jw9-5hrc-m4j6 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://reddit.com/r/VulnMatter/comments/1ryvfc9/resumen_diario_de_vulnerabilidades_20032026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2036224373451829488 · Twitter Post