CVE-2026-33493: Path Traversal in wwbn/avideo

The primary impact of CVE-2026-33493 is the ability for an authenticated attacker to read arbitrary files on the server. The vulnerability lies within the objects/import.json.php endpoint, where the fileURI parameter lacks proper directory restriction. An attacker can craft a malicious fileURI value to bypass the regex check and access files outside the intended videos/ directory. This could lead to the exposure of sensitive data such as user configuration files, application code, or even other users' private video content. The potential for lateral movement is limited to the attacker's ability to leverage the accessed files for further exploitation, but the blast radius could be significant depending on the data exposed.

1. Reserved2026-03-20
2. Published2026-03-20
3. Modified2026-03-25
4. EPSS updated2026-03-31

The primary mitigation for CVE-2026-33493 is to upgrade to a patched version of wwbn/avideo as soon as it becomes available. Until a patch is applied, consider implementing temporary workarounds. These may include restricting access to the objects/import.json.php endpoint to trusted users only, or implementing a Web Application Firewall (WAF) rule to block requests with suspicious fileURI values. Carefully review and strengthen input validation on all file upload endpoints. After upgrade, confirm the vulnerability is resolved by attempting to access a file outside the intended videos/ directory via the objects/import.json.php endpoint and verifying that access is denied.