CVE-2026-33493 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a broken access control vulnerability caused by insufficient directory restriction in objects/import.json.php allowing authenticated users with upload permission to access or delete other users' private video and adjacent files.

Severity & Score

Impact

Authenticated users with upload permission can steal or delete other users' private video and adjacent files, compromising data confidentiality and integrity.

Mitigation

Update to the version including commit e110ff542acdd7e3b81bdd02b8402b9f6a61ad78 or later.

References

• https://github.com/WWBN/AVideo/commit/e110ff542acdd7e3b81bdd02b8402b9f6a61ad78
• https://github.com/WWBN/AVideo/security/advisories/GHSA-83xq-8jxj-4rxm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner