PT-2026-27169 · Wwbn · Avideo

Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-33647

NVD

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the ImageGallery::saveFile() method validates uploaded file content using finfo MIME type detection but derives the saved filename extension from the user-supplied original filename without an allowlist check. An attacker can upload a polyglot file (valid JPEG magic bytes followed by PHP code) with a .php extension. The MIME check passes, but the file is saved as an executable .php file in a web-accessible directory, achieving Remote Code Execution. Commit 345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae contains a patch.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-33647

Affected Products

Avideo

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33647 · Security Note
• https://github.com/WWBN/AVideo/security/advisories/GHSA-wxjw-phj6-g75w · Note
• https://github.com/WWBN/AVideo/commit/345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae · Note