CVE-2026-33478
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. The clones.json.php endpoint exposes clone secret keys without authentication, which can be used to trigger a full database dump via cloneServer.json.php. The dump contains admin password hashes stored as MD5, which are trivially crackable. With admin access, the attacker exploits an OS command injection in the rsync command construction in cloneClient.json.php to execute arbitrary system commands. Commit c85d076375fab095a14170df7ddb27058134d38c contains a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
wwbn/avideoPackagist | <= 26.0 | — |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/WWBN/AVideo/commit/c85d076375fab095a14170df7ddb27058134d38cnvdPatchWEB
- github.com/WWBN/AVideo/security/advisories/GHSA-687q-32c6-8x68nvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-687q-32c6-8x68ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33478ghsaADVISORY
News mentions
0No linked articles in our index yet.