PT-2026-27185 · Avideo · Avideo

Restriction · Published 2026-03-23 · Updated 2026-03-25 · CVE-2026-33681

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The objects/pluginRunDatabaseScript.json.php API endpoint accepts a name parameter via POST and passes it to the Plugin::getDatabaseFileName() function without proper path traversal sanitization. This allows an authenticated administrator, or an attacker via Cross-Site Request Forgery (CSRF), to traverse outside the plugin directory and execute the contents of any install/install.sql file on the filesystem as raw SQL queries against the application database.

Recommendations Update to a version beyond 26.0.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-33681

GHSA-3HWV-X8G3-9QPR

Affected Products

Avideo

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33681.json · Exploit
• https://github.com/WWBN/AVideo/commit/81b591c509835505cb9f298aa1162ac64c4152cb · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-3hwv-x8g3-9qpr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3hwv-x8g3-9qpr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33681 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33681 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://github.com/advisories/GHSA-v8jw-8w5p-23g3 · Note
• https://twitter.com/vuldb/status/2036257496885756379 · Twitter Post