Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / packagist/wwbn/avideo/CVE-2026-28502
Advisory ID gitlab/packagist/wwbn/avideo/CVE-2026-28502
Aliases CVE-2026-28502
GHSA-v8jw-8w5p-23g3
Summary AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction An authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (3)
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/wwbn/avideo/CVE-2026-28502.yml
Reference id Reference type URL
https://github.com/WWBN/AVideo
https://github.com/WWBN/AVideo/commit/b739aeeb9ce34aed9961d2c155d597810f8229db
https://github.com/WWBN/AVideo/releases/tag/24.0
CVE-2026-28502 https://nvd.nist.gov/vuln/detail/CVE-2026-28502
GHSA-v8jw-8w5p-23g3 https://github.com/advisories/GHSA-v8jw-8w5p-23g3
GHSA-v8jw-8w5p-23g3 https://github.com/WWBN/AVideo/security/advisories/GHSA-v8jw-8w5p-23g3
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/wwbn/avideo/CVE-2026-28502.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-03-06T16:01:34Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/28xxx/CVE-2026-28502.json

Source Advisory: vulnrichment/CVE-2026-28502

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]