CVE-2026-28502

WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution. This issue has been patched in version 24.0.

• CWE-434

• https://github.com/WWBN/AVideo/commit/b739aeeb9ce34aed9961d2c155d597810f8229dbPatch
• https://github.com/WWBN/AVideo/releases/tag/24.0Product, Release Notes
• https://github.com/WWBN/AVideo/security/advisories/GHSA-v8jw-8w5p-23g3Vendor Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28497TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …9.1
• CVE-2026-28498Authlib is a Python library which builds OAuth and OpenID Co…7.5
• CVE-2026-28499LeafKit is a templating language with Swift-inspired syntax.…6.1
• CVE-2026-2850A vulnerability was found in yeqifu warehouse up to aaf29962…6.5
• CVE-2026-28500Open Neural Network Exchange (ONNX) is an open standard for …9.1
• CVE-2026-28501WWBN AVideo is an open source video platform. Prior to versi…9.8
• CVE-2026-28503Tandoor Recipes is an application for managing recipes, plan…6.5
• CVE-2026-28505Tautulli is a Python based monitoring and tracking tool for …10
• CVE-2026-28506Outline is a service that allows for collaborative documenta…4.3
• CVE-2026-28507Idno is a social publishing platform. Prior to version 1.6.4…7.2
• CVE-2026-28508Idno is a social publishing platform. Prior to version 1.6.4…8.6
• CVE-2026-28509LangBot is a global IM bot platform designed for LLMs. Prior…5.4