AVideo hat eine Unauthentifizierte Lokale Datei-Inklusion in API locale (RCE möglich mit beschreibbarem PHP)

The vulnerability resides in the plugin/API/get.json.php endpoint, where user-supplied input is concatenated into an include path without proper sanitization or canonicalization. This allows an attacker to traverse the file system and include arbitrary PHP files under the web root. Successful exploitation can lead to the disclosure of sensitive configuration files, source code, and other critical data. While initial exploitation typically results in file disclosure, an attacker who can place or control a PHP file within the accessible directory tree can escalate the attack to achieve remote code execution, effectively compromising the entire application server. This presents a significant risk, particularly in environments where wwbn/avideo is used to process user-uploaded content or handle sensitive data.

Organizations using wwbn/avideo in production environments, particularly those with publicly accessible endpoints, are at risk. Shared hosting environments where multiple users share the same server and file system are especially vulnerable, as an attacker could potentially exploit this vulnerability to gain access to other users' data.

• wordpress / composer / npm:

grep -r 'include($_GET['locale']);' /var/www/avideo/

• generic web:

curl -I 'http://your-avideo-site.com/plugin/API/get.json.php?locale=../../../../etc/passwd' | grep 'HTTP/1.1' # Check for 403 or 200

1. 2026-03-20Disclosure

   disclosure

1. Reserviert2026-03-20
2. Veröffentlicht2026-03-20
3. Geändert2026-03-25
4. EPSS aktualisiert2026-03-31

Due to the lack of a fixed version, immediate mitigation strategies are crucial. Implement strict input validation on the plugin/API/get.json.php endpoint to prevent path traversal attempts. Configure a Web Application Firewall (WAF) to block requests containing suspicious path patterns, such as ../ or absolute paths. Consider temporarily disabling the bypassSameDomainCheck functionality if it's not essential. Regularly scan the web root for unauthorized PHP files. After a patch is released, upgrade to the fixed version immediately and verify the fix by attempting to access a non-existent file via the vulnerable endpoint; it should return a 404 error instead of including a PHP file.

Zuletzt aktualisiert

29.0kürzlich