CVE-2026-33513 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a file inclusion vulnerability caused by unsanitized user input concatenated into an include path in the unauthenticated API endpoint 'APIName=locale', letting unauthenticated attackers perform file disclosure and potentially remote code execution if they control PHP files, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can disclose files and potentially execute arbitrary PHP code, leading to full server compromise.

Mitigation

Update to the latest version once a patch is available.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-8fw8-q79c-fp9m

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner