VulnerabilityAnalyzed

CVE-2026-28502

Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality.

CRITICAL 9.3EPSS 0.67%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution. This issue has been patched in version 24.0.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.67% probability · 50th percentile
CISA KEV: Not listed
Weakness: CWE-434
Affected: wwbn/avideo
Source: security-advisories@github.com

References

https://github.com/WWBN/AVideo/commit/b739aeeb9ce34aed9961d2c155d597810f8229dbPatch
https://github.com/WWBN/AVideo/releases/tag/24.0Product, Release Notes
https://github.com/WWBN/AVideo/security/advisories/GHSA-v8jw-8w5p-23g3Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.