PT-2026-27191 · Avideo · Avideo

Restriction · Published 2026-03-23 · Updated 2026-03-25 · CVE-2026-33717

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The downloadVideoFromDownloadURL() function in objects/aVideoEncoder.json.php saves remote content to a web-accessible temporary directory using the original URL's filename and extension, including .php. Providing an invalid resolution parameter triggers an early die() via forbiddenPage() before the temporary file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at videos/cache/tmpFile/. The function forbiddenPage() is involved in the process.

Recommendations Versions prior to and including 26.0 should be updated to a version containing commit 6da79b43484099a0b660d1544a63c07b633ed3a2. As a temporary workaround, restrict access to the objects/aVideoEncoder.json.php file.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-33717

GHSA-8WF4-C4X3-H952

Affected Products

Avideo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33717.json · Exploit
• https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952 · Vendor Advisory
• https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2 · Patch
• https://osv.dev/vulnerability/CVE-2026-33717 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8wf4-c4x3-h952 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33717 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/TheHackerWire/status/2036160673982620115 · Twitter Post
• https://twitter.com/cyberbivash/status/2036189941856715066 · Twitter Post
• https://twitter.com/CveFindCom/status/2036166982597280070 · Twitter Post