CVE-2026-33717: Wwbn Avideo RCE Vulnerability

CVE-2026-33717 Overview

CVE-2026-33717 is a critical unrestricted file upload vulnerability affecting WWBN AVideo, an open source video platform. The vulnerability exists in the downloadVideoFromDownloadURL() function within objects/aVideoEncoder.json.php, which improperly handles remote content downloads. The function saves fetched content to a web-accessible temporary directory while preserving the original URL's filename and extension, including executable extensions like .php.

By providing an invalid resolution parameter, an attacker can trigger an early die() call via the forbiddenPage() function before the temporary file can be properly moved or cleaned up. This leaves an executable PHP file persistently accessible under the web root at videos/cache/tmpFile/, enabling remote code execution on the vulnerable server.

Critical Impact

This vulnerability allows authenticated attackers to upload and execute arbitrary PHP code on vulnerable AVideo installations, potentially leading to complete server compromise, data theft, and lateral movement within the network.

Affected Products

• WWBN AVideo versions up to and including 26.0
• Self-hosted AVideo installations with default configurations
• AVideo deployments with web-accessible cache directories

Discovery Timeline

• 2026-03-23 - CVE CVE-2026-33717 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-33717

Vulnerability Analysis

The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type). The downloadVideoFromDownloadURL() function is designed to fetch video content from remote URLs and process it locally. However, the function fails to properly validate or sanitize the file extension of the downloaded content before writing it to the filesystem.

When a remote URL points to a file with a .php extension, the function downloads and saves the file while preserving its dangerous extension. The file is stored in a predictable, web-accessible location (videos/cache/tmpFile/), making it trivially accessible for execution via HTTP requests.

The attack is made persistent through an error handling flaw: by supplying an invalid resolution parameter, the attacker forces the application to terminate early through the forbiddenPage() function. This premature termination occurs after the file has been written but before any cleanup or relocation logic can execute, leaving the malicious file permanently in the cache directory.

Root Cause

The root cause is twofold: first, the application fails to validate file extensions against an allowlist of safe content types before saving downloaded files. Second, the error handling path through forbiddenPage() does not include cleanup logic for partially processed files, allowing attackers to exploit the race condition between file creation and normal processing completion.

Attack Vector

This vulnerability is exploitable over the network by authenticated users with low privilege requirements. The attack requires no user interaction and follows this sequence:

1. An authenticated attacker crafts a request to the vulnerable endpoint with a URL pointing to a malicious PHP file hosted on an attacker-controlled server
2. The attacker includes an invalid resolution parameter in the request
3. AVideo downloads the remote PHP file and saves it to videos/cache/tmpFile/ with its original filename
4. The invalid resolution triggers forbiddenPage(), terminating execution before cleanup
5. The attacker accesses the uploaded PHP file directly via the web server, achieving code execution

The vulnerability mechanism involves the application downloading remote content without extension validation and the error handling flow allowing file persistence. For complete technical details, refer to the GitHub Security Advisory GHSA-8wf4-c4x3-h952.

Detection Methods for CVE-2026-33717

Indicators of Compromise

• Presence of .php files in the videos/cache/tmpFile/ directory that were not created by legitimate application processes
• HTTP access logs showing requests to files under videos/cache/tmpFile/ with .php extensions
• Web server logs indicating requests to objects/aVideoEncoder.json.php with unusual or malformed resolution parameters
• Unexpected outbound connections from the web server to external hosts during video processing operations

Detection Strategies

• Implement file integrity monitoring on the videos/cache/ directory tree to detect unexpected file creations
• Configure web application firewalls to alert on requests containing .php in URL parameters destined for download functions
• Monitor for HTTP 403/500 responses from aVideoEncoder.json.php followed by direct access to cache directories
• Deploy endpoint detection solutions to identify PHP file execution from non-standard web application directories

Monitoring Recommendations

• Enable verbose logging for file operations within the AVideo application directory
• Configure SIEM rules to correlate download requests with subsequent file access in cache directories
• Implement real-time alerting for any executable file creation in temporary or cache directories
• Review web server access logs regularly for suspicious patterns involving the tmpFile directory

How to Mitigate CVE-2026-33717

Immediate Actions Required

• Upgrade WWBN AVideo to a version containing commit 6da79b43484099a0b660d1544a63c07b633ed3a2 or later
• Audit the videos/cache/tmpFile/ directory for any existing .php files and remove them immediately
• Implement web server configuration to deny execution of PHP files in cache directories
• Review access logs for evidence of prior exploitation attempts

Patch Information

The vulnerability has been addressed in commit 6da79b43484099a0b660d1544a63c07b633ed3a2. Organizations should update their AVideo installations by pulling the latest changes from the official repository. The patch details are available in the GitHub Commit Update and the full advisory can be reviewed at the GitHub Security Advisory GHSA-8wf4-c4x3-h952.

Workarounds

• Configure web server to disable PHP execution in the videos/cache/ directory and its subdirectories using appropriate directives
• Implement strict file extension validation at the web server level to block requests for .php files in cache directories
• Deploy a web application firewall rule to block requests containing suspicious extensions in download URL parameters
• Consider implementing network segmentation to limit the impact of potential server compromise

# Apache configuration example to disable PHP execution in cache directory
# Add to .htaccess in videos/cache/ or to virtual host configuration
<Directory "/var/www/html/avideo/videos/cache">
    php_admin_flag engine off
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx configuration example
location ~* /videos/cache/.*\.php$ {
    deny all;
    return 403;
}