CVE-2026-33513
WWBN AVideo is an open source video platform.
Published Mar 23, 2026 · updated Jun 17, 2026 · wwbn avideo
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint ( ) concatenates user input into an path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., ), and it *can* escalate to RCE if an attacker can place or control a PHP file elsewhere in the tree. As of time of publication, no patched versions are available.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 23, 2026 · NIST NVD
Detected
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint ( ) concatenates user input into an path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., ), and it *can*
Jun 17, 2026 · NIST NVD
Updated
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint ( ) concatenates user input into an path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., ), and it *can*
Affected
- cpe wwbn/avideoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33513
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33513
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint ( ) concatenates user input into an path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under th
nvd.nist.gov