CVE-2026-33483 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a denial of service caused by unauthenticated POST data written without limits to /tmp/ in aVideoEncoderChunk.json.php, letting remote attackers exhaust disk space.

Severity & Score

Impact

Remote attackers can exhaust disk space causing denial of service to the entire server.

Mitigation

Update to a version including commit 33d1bae6c731ef1682fcdc47b428313be073a5d1 or later.

References

• https://github.com/WWBN/AVideo/commit/33d1bae6c731ef1682fcdc47b428313be073a5d1
• https://github.com/WWBN/AVideo/security/advisories/GHSA-vv7w-qf5c-734w

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 23, 2026

🟠 CVE-2026-33483 - High (7.5) WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `aVideoEncoderChunk.json.php` endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthen... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33483/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner