Path traversal in AVideo - CVE-2026-33493
Published: April 8, 2026
Vulnerability identifier: #VU125463
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-33493
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: World Wide Broadcast Network
Affected software:
AVideo
AVideo
Detailed vulnerability description
The vulnerability allows a remote user to read arbitrary files, delete arbitrary files, and bypass access controls to access private video content.
The vulnerability exists due to path traversal in objects/import.json.php when processing a user-supplied fileURI parameter. A remote user can send a specially crafted request to read arbitrary files, delete arbitrary files, and bypass access controls to access private video content.
Exploitation requires upload permission. Adjacent .txt, .html, and .htm files may be disclosed through the imported video's description field, and deletion succeeds only for files writable by the web server process.
How to mitigate CVE-2026-33493
Install security update from vendor's website.