CVE-2026-33483
WWBN AVideo is an open source video platform.
Published Mar 23, 2026 · updated Jun 17, 2026 · wwbn avideo
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthenticated remote attacker can send arbitrary POST data which is written to persistent temp files in with no size cap, no rate limiting, and no cleanup mechanism. This allows trivial disk space exhaustion leading to denial of service of the entire server. Commit 33d1bae6c731ef1682fcdc47b428313be073a5d1 contains a patch.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 23, 2026 · NIST NVD
Detected
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthenticated remote attacker can send arbitrary POST data which is written to persistent temp files in with no size cap, no rate limiting, and no cleanup mechanism. This allows trivial dis
Jun 17, 2026 · NIST NVD
Updated
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthenticated remote attacker can send arbitrary POST data which is written to persistent temp files in with no size cap, no rate limiting, and no cleanup mechanism. This allows trivial dis
Affected
- cpe wwbn/avideoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33483
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33483
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthenticated remote attacker can send
nvd.nist.gov