Wwbn Avideo vulnerabilities

CVE-2026-33478 [CRITICAL] CWE-78 CVE-2026-33478: WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnera WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. The `clones.json.php` endpoint exposes clone secret keys without authentication, which can be used to trigger a full

CVE-2023-48728 [MEDIUM] CWE-79 CVE-2023-48728: A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionalit A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

CVE-2026-29058 [CRITICAL] CWE-78 WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php ## Impact An unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the `base64Url` GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, intern

CVE-2024-31819 [CRITICAL] CWE-94 CVE-2024-31819: An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.

CVE-2026-28501 [CRITICAL] CWE-89 CVE-2026-28501: WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injectio WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is p

CVE-2022-30547 [CRITICAL] CWE-22 CVE-2022-30547: A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 a A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

CVE-2022-30534 [HIGH] CWE-78 CVE-2022-30534: An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AV An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

CVE-2025-34441 [HIGH] CWE-359 CVE-2025-34441: AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public AP AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations.

CVE-2025-34442 [HIGH] CWE-497 CVE-2025-34442: AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.

CVE-2022-32572 [HIGH] CWE-78 CVE-2022-32572: An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

CVE-2026-41304 [CRITICAL] CWE-77 CVE-2026-41304: WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands using user-controlled input (`url` parameter) without proper sanitization. The input is directly concatenated into a `wget` command executed via `exec()`, allowing command injection. An atta

CVE-2026-40911 [CRITICAL] CWE-94 CVE-2026-40911: WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's Web WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the `msg` or `callback` fields. On the client side, `plugin/YPTSocket/script.js` contains two `eval()` sinks fed directly by those relayed fields

CVE-2026-86189 [CRITICAL] CWE-73 CVE-2026-86189: WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenti WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypas

CVE-2026-28502 [HIGH] CWE-434 CVE-2026-28502: WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Ex WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficie

CVE-2023-32073 [HIGH] CVE-2023-32073: WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulner WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2

CVE-2026-59808 [HIGH] CWE-306 CVE-2026-59808: AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEn AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_queue_id without ownership verification, and useVideoHashOrLogin() converts this hash into passwordless login as the video owner. Attackers with upload permission can retrieve an

CVE-2026-33482 [HIGH] CWE-78 CVE-2026-33482: WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFm WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&&`, `;`, `|`, `` ` ``, ``). However, it fails to strip `$()` (bash command subst

CVE-2026-72748 [CRITICAL] CWE-306 CVE-2026-72748: AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline

CVE-2025-34434 [CRITICAL] CWE-306 CVE-2025-34434: AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based vide

CVE-2026-55173 [HIGH] CWE-78 AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink ### Summary The fix for CVE-2026-33482 (GHSA-pmj8-r2j7-xg6c) is incomplete. That advisory reported that `sani