Staging Environment: Content and features may be unstable or change without notice.
Advisory details: vulnrichment / CVE-2026-28502
Advisory ID vulnrichment/CVE-2026-28502
Aliases
Summary WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution. This issue has been patched in version 24.0.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-434 Unrestricted Upload of File with Dangerous Type
System Score Found at
cvssv4 9.3
ssvc Track
Reference id Reference type URL
https://github.com/WWBN/AVideo/commit/b739aeeb9ce34aed9961d2c155d597810f8229db
https://github.com/WWBN/AVideo/releases/tag/24.0
GHSA-v8jw-8w5p-23g3 https://github.com/WWBN/AVideo/security/advisories/GHSA-v8jw-8w5p-23g3
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at None
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-03-06T16:01:34Z/ Found at None

Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-03-06T16:01:34Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/28xxx/CVE-2026-28502.json

Source Advisory: vulnrichment/CVE-2026-28502

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]