CVE-2026-28502 | THREATINT

Description

WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution. This issue has been patched in version 24.0.

PUBLISHED Reserved 2026-02-27 | Published 2026-03-06 | Updated 2026-03-06 | Assigner GitHub_M

CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-434: Unrestricted Upload of File with Dangerous Type

Product status

< 24.0

affected

References

github.com/...AVideo/security/advisories/GHSA-v8jw-8w5p-23g3

github.com/...ommit/b739aeeb9ce34aed9961d2c155d597810f8229db

github.com/WWBN/AVideo/releases/tag/24.0

cve.org (CVE-2026-28502)

nvd.nist.gov (CVE-2026-28502)

Download JSON