CVE-2026-33513: Path Traversal in wwbn/avideo

The vulnerability lies in the plugin/API/get.json.php endpoint, where user-supplied input is concatenated into an include path without proper sanitization or canonicalization. This allows an attacker to traverse the file system and include arbitrary PHP files under the web root. Successful exploitation can lead to the disclosure of sensitive configuration files, source code, and other critical data. Furthermore, if an attacker can upload or control a PHP file within the accessible directory structure, they can achieve remote code execution, effectively compromising the entire application. This mirrors the impact of other path traversal vulnerabilities where file inclusion is leveraged for malicious purposes.

1. Reserved2026-03-20
2. Published2026-03-20
3. Modified2026-03-25
4. EPSS updated2026-03-31

The primary mitigation is to upgrade to a patched version of wwbn/avideo that addresses this vulnerability. Until an upgrade is possible, consider implementing temporary workarounds. A Web Application Firewall (WAF) can be configured to block requests containing suspicious path traversal patterns, such as sequences of ../. Carefully review and restrict access to the plugin/API/get.json.php endpoint. Monitor access logs for unusual file inclusion attempts. Implement strict input validation and sanitization on all user-supplied data to prevent path traversal attacks. After upgrade, confirm by attempting to access the vulnerable endpoint with a crafted path traversal payload and verifying that access is denied.