ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33493

WWBN AVideo is an open source video platform.

Published Mar 23, 2026 · updated Jun 17, 2026 · wwbn avideo

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint accepts a user-controlled POST parameter with only a regex check that the value ends in . Unlike , which was hardened with a + directory prefix check to restrict paths to the directory, performs no directory restriction. This allows an authenticated user with upload permission to: (1) steal any other user's private video files by importing them into their own account, (2) read / / files adjacent to any file on the filesystem, and (3) delete and adjacent text files if writable by the web server process. Commit e110ff542acdd7e3b81bdd02b8402b9f6a61ad78 contains a patch.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 23, 2026 · NIST NVD

    Detected

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint accepts a user-controlled POST parameter with only a regex check that the value ends in . Unlike , which was hardened with a + directory prefix check to restrict paths to the directory, performs no directory restriction. This allows an authenticated user with upload permission to: (1) steal any other u

  2. Jun 17, 2026 · NIST NVD

    Updated

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint accepts a user-controlled POST parameter with only a regex check that the value ends in . Unlike , which was hardened with a + directory prefix check to restrict paths to the directory, performs no directory restriction. This allows an authenticated user with upload permission to: (1) steal any other u

Affected

  • cpe wwbn/avideoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33493

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33493

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint accepts a user-controlled POST parameter with only a regex check that the value ends in . Unlike , which was hard

    nvd.nist.gov

References