Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-33513 is a high-severity vulnerability in the WWBN AVideo open source video platform (versions up to 26.0). It affects an unauthenticated API endpoint called 'locale' that accepts user input and directly concatenates it into a PHP include path without any validation or restrictions."}, {'type': 'paragraph', 'content': "Because the input is not sanitized or restricted, attackers can perform path traversal attacks by including sequences like '../' to access arbitrary PHP files anywhere under the web root."}, {'type': 'paragraph', 'content': 'This allows attackers to disclose files and execute PHP code from those files. If an attacker can upload or control a PHP file elsewhere on the server, they can achieve remote code execution (RCE).'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including:

• File Disclosure: Attackers can read arbitrary PHP files on the server, potentially exposing sensitive information such as configuration files or secrets.
• Code Execution: By including attacker-controlled PHP files, attackers can execute arbitrary code on the server, leading to full remote code execution.
• Confidentiality Breach: Sensitive data can be leaked through disclosed files.
• No authentication is required to exploit this vulnerability, making it easy for attackers to leverage it remotely over the network.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access the vulnerable API endpoint with path traversal payloads in the `language` parameter to see if arbitrary PHP files under the web root are included and executed.'}, {'type': 'paragraph', 'content': 'A practical detection method is to send an HTTP GET request to the endpoint `/plugin/API/get.json.php` with parameters `APIName=locale` and `language` set to a path traversal string such as `../view/about`.'}, {'type': 'paragraph', 'content': 'Example command using curl to detect file disclosure:'}, {'type': 'list_item', 'content': 'curl -i "http://<target>/plugin/API/get.json.php?APIName=locale&language=../view/about"'}, {'type': 'paragraph', 'content': 'If the response contains the content of the `about.php` page or other unexpected PHP files, the vulnerability is present.'}, {'type': 'paragraph', 'content': 'For detecting potential Remote Code Execution (RCE), if an attacker-controlled PHP file exists, the following command can be used to test execution:'}, {'type': 'list_item', 'content': 'curl -i "http://<target>/plugin/API/get.json.php?APIName=locale&language=../videos/locale/shell&x=whoami"'}, {'type': 'paragraph', 'content': 'If the output of the command (e.g., the username running the web server) is returned, RCE is confirmed.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Reject any path separators (`/`, `\`) and dot characters (`.`) in the `language` parameter to prevent path traversal.
• Enforce a strict allowlist of valid locale slugs to ensure only expected language files are included.
• Use `realpath()` or equivalent to canonicalize the target file path and verify it remains within the intended `locale/` directory before including.
• Avoid using PHP `include` to load translation files; instead, load translations from safe, vetted formats such as JSON or PHP arrays.
• Add authentication mechanisms such as API secrets or tokens to restrict access to the vulnerable API endpoint.

Since no patched versions are available at the time of the advisory, these mitigations should be applied manually or via configuration changes.

Useful 0 Not Useful 0