#VU125463 Path traversal in AVideo - CVE-2026-33493
Published: April 8, 2026
Vulnerability identifier: #VU125463
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-33493
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
AVideo
AVideo
Software vendor:
World Wide Broadcast Network
World Wide Broadcast Network
Description
The vulnerability allows a remote user to read arbitrary files, delete arbitrary files, and bypass access controls to access private video content.
The vulnerability exists due to path traversal in objects/import.json.php when processing a user-supplied fileURI parameter. A remote user can send a specially crafted request to read arbitrary files, delete arbitrary files, and bypass access controls to access private video content.
Exploitation requires upload permission. Adjacent .txt, .html, and .htm files may be disclosed through the imported video's description field, and deletion succeeds only for files writable by the web server process.
Remediation
Install security update from vendor's website.