Path Traversal Vulnerability in WWBN AVideo Open Source Video Platform
CVE-2026-33681

7.2HIGH

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
23 March 2026

What is CVE-2026-33681?

The WWBN AVideo platform, an open source solution for video management, is susceptible to a path traversal vulnerability through the objects/pluginRunDatabaseScript.json.php endpoint in versions up to and including 26.0. This flaw allows an authenticated administrator or a potential attacker leveraging Cross-Site Request Forgery (CSRF) to manipulate the name parameter without proper sanitization. Consequently, this enables unauthorized file access, allowing execution of raw SQL queries from any arbitrary install/install.sql file located outside the intended plugin directory. Proper mitigation measures have been introduced as noted in commit 81b591c509835505cb9f298aa1162ac64c4152cb.

Affected Version(s)

AVideo <= 26.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-3...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/81b591c509835505cb9...
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.