SB2026050467 - Multiple vulnerabilities in AVideo

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026050467

SB2026050467 - Multiple vulnerabilities in AVideo

Published: May 4, 2026 Updated: November 8, 2026

Security Bulletin ID SB2026050467
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-33237)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to server-side request forgery in the Scheduler plugin run() function in plugin/Scheduler/Scheduler.php when processing an admin-configurable callbackURL. A remote privileged user can configure a scheduled task with a crafted callbackURL and trigger execution to disclose sensitive information.

The issue can be used to access internal APIs and cloud metadata endpoints, and the response is stored in the scheduler execution log.


2) Path traversal (CVE-ID: CVE-2026-33238)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to path traversal in listFiles.json.php when handling a user-supplied path parameter. A remote user can send a specially crafted POST request to disclose sensitive information.

The issue is limited to enumeration of .mp4 filenames and their full absolute filesystem paths, and no user interaction is required.


3) Cross-site scripting (CVE-ID: CVE-2024-34899)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an unauthenticated attacker to execute malicious scripts in the browser of a user viewing an affected AVideo page.

The vulnerability exists due to missing sanitization of the User-Agent header when AVideo renders view/about.php in response to a request. An unauthenticated attacker can supply a crafted User-Agent header to inject script into the generated page, which executes when the response is viewed in a browser.


Remediation

Install update from vendor's website.

References