What is the CVSS score of CVE-2026-33647?

CVE-2026-33647 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-33647?

WWBN AVideo installations (versions ≤26.0) are vulnerable to remote code execution through authenticated file upload attacks, potentially allowing attackers to gain complete control of affected…

How to fix or mitigate CVE-2026-33647?

Within 24 hours: Inventory all WWBN AVideo deployments and their versions; restrict access to image upload functionality to trusted users only; enable comprehensive logging on file operations. Within 7 days: Apply the security patch from commit 345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae or upgrade to the patched version; conduct logs review for suspicious upload activity. Within 30 days: Perform security assessment of patched systems; implement file upload validation independent of extension handling; conduct user awareness training on social engineering vectors that could exploit authenticated access.

PHP CVE-2026-33647

EUVD-2026-14482 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-23 GitHub_M

GHSA-wxjw-phj6-g75w

PHP RCE File Upload

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 18:45 euvd

EUVD-2026-14482

Analysis Generated

Mar 23, 2026 - 18:45 vuln.today

CVE Published

Mar 23, 2026 - 18:23 nvd

HIGH 8.8

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the ImageGallery::saveFile() method validates uploaded file content using finfo MIME type detection but derives the saved filename extension from the user-supplied original filename without an allowlist check. An attacker can upload a polyglot file (valid JPEG magic bytes followed by PHP code) with a .php extension. The MIME check passes, but the file is saved as an executable .php file in a web-accessible directory, achieving Remote Code Execution. Commit 345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae contains a patch.

AnalysisAI

WWBN AVideo versions up to and including 26.0 contain a critical file upload vulnerability in the ImageGallery::saveFile() method that allows authenticated attackers to upload polyglot files (JPEG with embedded PHP code) and achieve Remote Code Execution. The vulnerability exploits a mismatch between MIME type validation (which checks file content) and filename extension handling (which trusts user input), allowing attackers to bypass security controls and execute arbitrary code on the server. A patch is available in commit 345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae, and the issue has been publicly disclosed via GitHub Security Advisory GHSA-wxjw-phj6-g75w.

Technical ContextAI

This vulnerability affects WWBN AVideo (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), an open-source video platform built on PHP. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), which occurs when the ImageGallery::saveFile() method validates file content using PHP's finfo library for MIME type detection but fails to validate the file extension against an allowlist before saving. The method derives the saved filename extension directly from the user-supplied original filename, creating a logic flaw where polyglot files can pass content validation while retaining dangerous executable extensions. This is a classic example of incomplete input validation where different components of the security control (content check vs. filename check) operate independently without proper coordination.

RemediationAI

Apply the security patch available in commit 345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae from the WWBN AVideo GitHub repository (https://github.com/WWBN/AVideo/commit/345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae). Review the full security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-wxjw-phj6-g75w for additional context and upgrading to the next stable release that incorporates this fix. Until patching is complete, implement compensating controls including restricting file upload functionality to highly trusted administrators only, implementing strict file extension allowlists at the web server or WAF level to block PHP and other executable extensions in upload directories, ensuring upload directories have execute permissions disabled at the filesystem level, and monitoring for suspicious file uploads with polyglot characteristics. Consider temporarily disabling the ImageGallery upload feature if not business-critical until the patch can be applied.