WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginRunDatabaseScript.json.php` endpoint accepts a `name` parameter via POST and passes it to `Plugin::getDatabaseFileName()` without any path traversal sanitization. This allows an authenticated admin (or an attacker via CSRF) to traverse outside the plugin directory and execute the contents of any `install/install.sql` file on the filesystem as raw SQL queries against the application database. Commit 81b591c509835505cb9f298aa1162ac64c4152cb contains a patch.

Affected: Packagist: wwbn/avideo

## Summary

The `objects/pluginRunDatabaseScript.json.php` endpoint accepts a `name` parameter via POST and passes it to `Plugin::getDatabaseFileName()` without any path traversal sanitization. This allows an authenticated admin (or an attacker via CSRF) to traverse outside the plugin directory and execute the contents of any `install/install.sql` file on the filesystem as raw SQL queries against the application database.

## Details

The vulnerable data flow:

**1. Entry point** — `objects/pluginRunDatabaseScript.json.php:21`: ```php $fileName = Plugin::getDatabaseFileName($_POST['name']); ```

**2. "Sanitization"** — `objects/plugin.php:343-354`: ```php public static function getDatabaseFileName($pluginName) { global $global; $pluginName = AVideoPlugin::fixName($pluginName); // line 347 — no-op $dir = $global['systemRootPath'] . "plugin"; $filename = $dir . DIRECTORY_SEPARATOR . $pluginName . DIRECTORY_SEPARATOR . "install" . DIRECTORY_SEPARATOR . "install.sql"; if (!file_exists($filename)) { return false; } return $filename; } ```

**3. The "fix"** — `plugin/AVideoPlugin.php:3184-3190`: ```php public static function fixName($name) { if ($name === 'Programs') { return 'PlayLists'; } return $name; // Returns input unchanged for all other values } ```

**4. SQL execution** — `objects/pluginRunDatabaseScript.json.php:24-36`: ```php $lines = file($fileName); foreach ($lines as $line) { // ... if (!$global['mysql…