CVE-2026-33493: Wwbn Avideo Path Traversal Vulnerability

CVE-2026-33493 Overview

CVE-2026-33493 is a Path Traversal vulnerability affecting WWBN AVideo, an open source video platform. The vulnerability exists in the objects/import.json.php endpoint, which accepts a user-controlled fileURI POST parameter with only a regex check that the value ends in .mp4. Unlike the hardened objects/listFiles.json.php endpoint which uses realpath() with a directory prefix check to restrict paths to the videos/ directory, the vulnerable endpoint performs no directory restriction.

This flaw allows an authenticated user with upload permission to access files outside intended directories, potentially compromising the confidentiality and integrity of the system.

Critical Impact

Authenticated attackers can steal private video files from other users, read sensitive text files adjacent to any .mp4 file, and delete files writable by the web server process.

Affected Products

• WWBN AVideo versions up to and including 26.0

Discovery Timeline

• 2026-03-23 - CVE CVE-2026-33493 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33493

Vulnerability Analysis

The vulnerability resides in the objects/import.json.php endpoint of WWBN AVideo. The endpoint is designed to allow users to import video files by specifying a file URI. However, the implementation only validates that the provided fileURI parameter ends with the .mp4 extension using a simple regex check. This inadequate validation fails to prevent path traversal sequences such as ../ from being included in the file path.

The root issue is the inconsistent security posture between similar endpoints. While objects/listFiles.json.php was previously hardened with proper security controls including realpath() resolution and directory prefix verification to ensure all operations remain within the videos/ directory, the import.json.php endpoint lacks these critical safeguards.

This enables three distinct attack scenarios: stealing other users' private videos by importing them into an attacker's account, reading .txt, .html, or .htm files that exist adjacent to any .mp4 file on the filesystem, and deleting .mp4 files along with adjacent text files when those files are writable by the web server process.

Root Cause

The root cause is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability. The objects/import.json.php endpoint fails to properly sanitize user-supplied file paths before processing them. The extension-only validation provides a false sense of security while allowing arbitrary directory traversal. The missing realpath() canonicalization and directory boundary checks that were implemented in related endpoints were not applied to this import functionality.

Attack Vector

The attack is network-based and requires low-privilege authentication with upload permissions. An attacker can craft malicious POST requests to the objects/import.json.php endpoint with specially crafted fileURI values containing path traversal sequences followed by a .mp4 extension to satisfy the regex check.

For example, an attacker could supply a path like ../../../etc/private_videos/victim_video.mp4 to import another user's private video into their own account, effectively stealing confidential content. The lack of directory restriction means any .mp4 file accessible to the web server process can be targeted, regardless of its intended access controls.

Detection Methods for CVE-2026-33493

Indicators of Compromise

• Unexpected POST requests to /objects/import.json.php containing ../ or encoded traversal sequences in the fileURI parameter
• Web server logs showing import operations referencing file paths outside the videos/ directory
• Audit logs indicating users gaining access to videos they did not originally upload
• File system changes or deletions in directories that should not be modified by the application

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in POST parameters
• Monitor application logs for anomalous import activity, particularly requests with encoded characters like %2e%2e%2f
• Enable file integrity monitoring on sensitive directories to detect unauthorized reads or deletions
• Review access logs for the import.json.php endpoint for patterns indicating exploitation attempts

Monitoring Recommendations

• Configure alerting for multiple failed or successful import attempts from the same user session targeting varied file paths
• Implement rate limiting on the import endpoint to slow down enumeration attacks
• Monitor for unusual file access patterns by the web server process in directories outside the application scope

How to Mitigate CVE-2026-33493

Immediate Actions Required

• Upgrade WWBN AVideo to a version containing commit e110ff542acdd7e3b81bdd02b8402b9f6a61ad78 or later
• Restrict access to the objects/import.json.php endpoint to only trusted administrators until patching is complete
• Review access logs to identify any potential exploitation that may have already occurred
• Audit file permissions to ensure the web server process has minimal write access to the filesystem

Patch Information

The vulnerability is addressed in commit e110ff542acdd7e3b81bdd02b8402b9f6a61ad78. This fix applies the same security controls used in objects/listFiles.json.php to the vulnerable import endpoint, including realpath() canonicalization and directory prefix verification to ensure all file operations are restricted to the intended videos/ directory.

For detailed patch information, refer to the GitHub Commit Reference and the GitHub Security Advisory GHSA-83xq-8jxj-4rxm.

Workarounds

• Deploy a web application firewall rule to block requests to import.json.php containing path traversal patterns
• Temporarily disable the import functionality by restricting access to the endpoint via web server configuration
• Implement additional authentication requirements for the import feature as an interim control
• Apply filesystem-level restrictions to limit the web server user's read and write access to only necessary directories

# Apache configuration to restrict access to vulnerable endpoint
<Location /objects/import.json.php>
    Order deny,allow
    Deny from all
    # Allow only from trusted admin IPs
    Allow from 10.0.0.0/8
</Location>