https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 05:32:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274797 EUVD-2026-274797 https://cve.radiocsirt.org/vuln/euvd-2026-274797 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28502 <p>WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution. This issue has been patched in version 24.0.</p> <p>WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution. This issue has been patched in version 24.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28502 https://cve.radiocsirt.org/vuln/ghsa-v8jw-8w5p-23g3 <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary An authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality.</p> <p>The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution.</p> <p>## Vulnerability Type - Remote Code Execution (RCE) - CWE-434: Unrestricted Upload of File with Dangerous Type</p> <p>## Affected Versions - All versions up to and including 22.x.</p> <p>## Fixed Version - A fix is expected to be released in version 23.</p> <p>## Root Cause The system validated only the ZIP extension of uploaded plugin packages but did not enforce a strict allowlist of file types within the archive. Extracted files were placed directly in a web-accessible directory without preventing execution of server-side scripts.</p> <p>## Impact An authenticated administrator could execute arbitrary code on the server, resulting in full system compromise, including: - Confidentiality loss - Integrity loss - Availability impact</p> <p>## Remediation Upgrade immediately to **AVideo version 23 or later**.</p> <p>Version 23 introduces improved validation and secure handling of plugin extraction.</p> <p>## Workarounds If upgrade is not immediately possible: - Disable plugin upload/import functionality. - Configure the web server to prevent execution of PHP files inside pl…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary An authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality.</p> <p>The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution.</p> <p>## Vulnerability Type - Remote Code Execution (RCE) - CWE-434: Unrestricted Upload of File with Dangerous Type</p> <p>## Affected Versions - All versions up to and including 22.x.</p> <p>## Fixed Version - A fix is expected to be released in version 23.</p> <p>## Root Cause The system validated only the ZIP extension of uploaded plugin packages but did not enforce a strict allowlist of file types within the archive. Extracted files were placed directly in a web-accessible directory without preventing execution of server-side scripts.</p> <p>## Impact An authenticated administrator could execute arbitrary code on the server, resulting in full system compromise, including: - Confidentiality loss - Integrity loss - Availability impact</p> <p>## Remediation Upgrade immediately to **AVideo version 23 or later**.</p> <p>Version 23 introduces improved validation and secure handling of plugin extraction.</p> <p>## Workarounds If upgrade is not immediately possible: - Disable plugin upload/import functionality. - Configure the web server to prevent execution of PHP files inside pl…</p> https://cve.radiocsirt.org/vuln/ghsa-v8jw-8w5p-23g3