Remote Code Execution Vulnerability in WWBN AVideo Platform
CVE-2026-33717

8.8HIGH

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
23 March 2026

What is CVE-2026-33717?

The WWBN AVideo platform, a popular open-source video tool, is susceptible to a remote code execution vulnerability. Found in versions up to and including 26.0, this flaw resides in the downloadVideoFromDownloadURL() function located in objects/aVideoEncoder.json.php. When an attacker manipulates the resolution parameter, they can exploit the vulnerability, causing an early termination which prevents cleanup of a temporarily created file. This file can retain an executable PHP script accessible via the web root at videos/cache/tmpFile/, posing significant security risks. A patch has been introduced in commit 6da79b43484099a0b660d1544a63c07b633ed3a2 to address this issue.

Affected Version(s)

AVideo <= 26.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-8...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/6da79b43484099a0b66...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.