CVE-2026-33483: Wwbn Avideo DOS Vulnerability

CVE-2026-33483 Overview

CVE-2026-33483 is a resource exhaustion vulnerability affecting WWBN AVideo, an open source video platform. The vulnerability exists in the aVideoEncoderChunk.json.php endpoint, which is implemented as a completely standalone PHP script lacking authentication, framework includes, and resource limits. An unauthenticated remote attacker can exploit this flaw to cause denial of service by exhausting disk space on the target server.

Critical Impact

Unauthenticated attackers can trivially exhaust disk space on affected servers, leading to complete denial of service of the entire system through uncontrolled file writes.

Affected Products

• WWBN AVideo versions up to and including 26.0
• Systems running vulnerable aVideoEncoderChunk.json.php endpoint
• All AVideo installations prior to commit 33d1bae6c731ef1682fcdc47b428313be073a5d1

Discovery Timeline

• 2026-03-23 - CVE CVE-2026-33483 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33483

Vulnerability Analysis

This vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) allows unauthenticated attackers to write arbitrary data to the server's filesystem without any restrictions. The vulnerable endpoint accepts POST data directly from php://input and writes it to temporary files in the /tmp/ directory. The implementation lacks several critical security controls: no authentication mechanism, no file size limits, no rate limiting, and no cleanup mechanism for orphaned files.

The attack requires no special privileges or user interaction, making it trivially exploitable from the network. An attacker can repeatedly send large POST requests to the vulnerable endpoint, causing temporary files to accumulate until the server's disk space is completely exhausted. This leads to denial of service not just for the AVideo application, but potentially for the entire server and any other services sharing the same filesystem.

Root Cause

The root cause stems from the aVideoEncoderChunk.json.php script operating as a standalone file without the security framework typically provided by the main application. The script unconditionally creates temporary files using tempnam() and writes incoming POST data without validating the source, limiting the data size, or implementing any cleanup logic. This design oversight allows unbounded resource consumption through a publicly accessible endpoint.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can send HTTP POST requests with arbitrary payloads to the /objects/aVideoEncoderChunk.json.php endpoint. Each request creates a new file with the prefix YTPChunk_ in /tmp/, and the data is written in 1MB chunks until the full payload is stored. By repeatedly sending requests with large payloads, an attacker can rapidly fill the available disk space.

The vulnerable code pattern:

// Vulnerable code from aVideoEncoderChunk.json.php (pre-patch)
// Source: https://github.com/WWBN/AVideo/commit/33d1bae6c731ef1682fcdc47b428313be073a5d1

-<?php
-header('Access-Control-Allow-Origin: *');
-header('Content-Type: application/json');
-$obj = new stdClass();
-$obj->file = tempnam(sys_get_temp_dir(), 'YTPChunk_');
-
-$putdata = fopen("php://input", "r");
-$fp = fopen($obj->file, "w");
-
-error_log("aVideoEncoderChunk.json.php: start {$obj->file} ");
-
-while ($data = fread($putdata, 1024 * 1024)) {
-    fwrite($fp, $data);
-}
-
-fclose($fp);
-fclose($putdata);
-sleep(1);
-$obj->filesize = filesize($obj->file);
-
-$json = json_encode($obj);
-
-error_log("aVideoEncoderChunk.json.php: {$json} ");
-
-die($json);

Source: GitHub Commit Update

Detection Methods for CVE-2026-33483

Indicators of Compromise

• Unusual accumulation of files with the prefix YTPChunk_ in the /tmp/ directory
• Rapid disk space consumption on servers hosting AVideo instances
• High volume of POST requests to /objects/aVideoEncoderChunk.json.php in web server logs
• System alerts or failures related to full filesystem conditions

Detection Strategies

• Monitor web server access logs for excessive POST requests to /objects/aVideoEncoderChunk.json.php, especially from single IP addresses or unusual user agents
• Implement filesystem monitoring to alert on rapid creation of temporary files matching the YTPChunk_* pattern
• Deploy network-based intrusion detection rules to identify bulk POST traffic to the vulnerable endpoint
• Set up threshold-based alerting for disk utilization spikes on AVideo servers

Monitoring Recommendations

• Configure real-time disk usage monitoring with alerts at 80% and 90% capacity thresholds
• Enable access logging for all PHP endpoints and review logs for unusual patterns
• Implement rate limiting at the web application firewall (WAF) or reverse proxy level for the affected endpoint
• Monitor system logs for out-of-space errors and application crashes that may indicate ongoing exploitation

How to Mitigate CVE-2026-33483

Immediate Actions Required

• Update WWBN AVideo to a version containing commit 33d1bae6c731ef1682fcdc47b428313be073a5d1 or later
• If immediate patching is not possible, restrict access to the /objects/aVideoEncoderChunk.json.php endpoint at the web server or firewall level
• Clean up existing orphaned YTPChunk_* files from the /tmp/ directory
• Implement rate limiting on the affected endpoint to reduce the impact of potential attacks

Patch Information

The vulnerability has been addressed in commit 33d1bae6c731ef1682fcdc47b428313be073a5d1. The patch implements file upload size limits and introduces a cleanup mechanism for orphaned chunk files older than 1 hour, preventing disk exhaustion attacks. See the GitHub Security Advisory GHSA-vv7w-qf5c-734w for additional details.

Workarounds

• Block access to /objects/aVideoEncoderChunk.json.php at the reverse proxy or firewall level if the encoding functionality is not required
• Implement web application firewall rules to rate-limit POST requests to the vulnerable endpoint
• Set up a cron job to periodically clean up old YTPChunk_* files from /tmp/ as a temporary measure
• Consider placing /tmp/ on a separate partition to limit the blast radius of disk exhaustion attacks

# Configuration example - Block access to vulnerable endpoint in nginx
location /objects/aVideoEncoderChunk.json.php {
    deny all;
    return 403;
}

# Alternative: Rate limiting in nginx
limit_req_zone $binary_remote_addr zone=avideo_chunk:10m rate=1r/s;
location /objects/aVideoEncoderChunk.json.php {
    limit_req zone=avideo_chunk burst=5 nodelay;
}