high8.8
CVE-2026-33647
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
Impact
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `ImageGallery::saveFile()` method validates uploaded file content using `finfo` MIME type detection but derives the saved filename extension from the user-supplied original filename without an allowlist check. An attacker can upload a polyglot file (valid JPEG magic bytes followed by PHP code) with a `.php` extension. The MIME check passes, but the file is saved as an executable `.php` file in a web-accessible directory, achieving Remote Code Execution. Commit 345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae contains a patch.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | wwbn/avideo | <= 26.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wwbn | Avideo | through 26.0 |