CVE-2026-33238

WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly to `glob()` without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by supplying arbitrary absolute paths, enumerating `.mp4` filenames and their full absolute filesystem paths wherever they exist on the server — including locations outside the web root, such as private or premium media directories. Version 26.0 contains a patch for the issue.

• CWE-22

• https://github.com/WWBN/AVideo/commit/870cf24a7632d4f1a5d5549b59103c18f39e3a21Patch
• https://github.com/WWBN/AVideo/issues/10403
• https://github.com/WWBN/AVideo/security/advisories/GHSA-4wmm-6qxj-fpj4Exploit, Mitigation, Vendor Advisory

Published

Mar 21, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33232AutoGPT is a workflow automation platform for creating, depl…7.5
• CVE-2026-33233AutoGPT is a workflow automation platform for creating, depl…7.6
• CVE-2026-33234AutoGPT is a workflow automation platform for creating, depl…5
• CVE-2026-33235AutoGPT is a workflow automation platform for creating, depl…7.7
• CVE-2026-33236NLTK (Natural Language Toolkit) is a suite of open source Py…8.1
• CVE-2026-33237WWBN AVideo is an open source video platform. Prior to versi…5.5
• CVE-2026-3324Zohocorp ManageEngine Log360 versions 13000 through 13013 ar…8.2
• CVE-2026-33241Salvo is a Rust web framework. Prior to version 0.89.3, Salv…7.5
• CVE-2026-33242Salvo is a Rust web framework. Versions 0.39.0 through 0.89.…7.5
• CVE-2026-33243barebox is a bootloader. In barebox from version 2016.03.0 t…8.2
• CVE-2026-33244React Router is a router for React. In versions 7.5.1 throug…5.4
• CVE-2026-33245React Router is a router for React. In versions 7.7.0 throug…4.7