CVE-2026-33354

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `POST /objects/aVideoEncoder.json.php` accepts a requester-controlled `chunkFile` parameter intended for staged upload chunks. Instead of restricting that path to trusted server-generated chunk locations, the endpoint accepts arbitrary local filesystem paths that pass `isValidURLOrPath()`. That helper allows files under broad server directories including `/var/www/`, the application root, cache, tmp, and `videos`, only rejecting `.php` files. For an authenticated uploader editing their own video, this becomes an arbitrary local file read. The endpoint copies the attacker-chosen local file into the attacker's public video storage path, after which it can be downloaded over HTTP. Commit 59bbd601a3f65a5b18c1d9e4eb11471c0a59214f contains a patch for the issue.

• CWE-73

• https://github.com/WWBN/AVideo/commit/59bbd601a3f65a5b18c1d9e4eb11471c0a59214fPatch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-4jw9-5hrc-m4j6Exploit, Vendor Advisory

Published

Mar 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33349fast-xml-parser allows users to process XML from JS object w…5.9
• CVE-2026-3335The Canto plugin for WordPress is vulnerable to Missing Auth…5.3
• CVE-2026-33350LORIS (Longitudinal Online Research and Imaging System) is a…7.5
• CVE-2026-33351WWBN AVideo is an open source video platform. Prior to versi…9.1
• CVE-2026-33352WWBN AVideo is an open source video platform. Prior to versi…9.8
• CVE-2026-33353Soft Serve is a self-hostable Git server for the command lin…6.5
• CVE-2026-33355Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2026-33356In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x,…7.7
• CVE-2026-33357In Meari client applications embedding "com.meari.sdk" (incl…7.5
• CVE-2026-33359In Meari IoT Cloud alert image storage on Alibaba OSS (lates…7.5
• CVE-2026-3336Improper certificate validation in PKCS7_verify() in AWS-LC …8.7
• CVE-2026-33361In Meari IoT SDK image handling (libmrplayer.so) as observed…7.5