Avideo CVE-2026-33647

Authenticated user (PR:L) with upload permission to AVideo image gallery in versions ≤26.0. Attacker uploads polyglot file (valid JPEG magic bytes + PHP code) with .php extension. File saved in web-accessible directory despite MIME validation, enabling RCE.

This vulnerability represents a critical real-world risk with a CVSS score of 8.8 (High). The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-based exploitation with low attack complexity requiring only low-level privileges (authenticated user) and no user interaction, leading to complete compromise of confidentiality, integrity, and availability. The technical impact is maximal since successful exploitation grants Remote Code Execution capabilities. The vulnerability requires authentication (PR:L), which provides some defense in depth, but once an attacker has low-privileged access (potentially through default credentials or social engineering), exploitation is straightforward. The availability of a GitHub Security Advisory and specific commit patch indicates this vulnerability is well-documented and understood by attackers. While EPSS data and KEV status are not provided in the intelligence sources, the combination of public disclosure, patch availability, clear exploitation path, and RCE impact make this a high-priority issue requiring immediate attention. The attack is automatable once credentials are obtained, and exploitation would likely result in full system compromise.

An authenticated attacker with low-level privileges creates a polyglot file by prepending valid JPEG magic bytes and header to PHP code containing a web shell, then names the file with a .php extension (e.g., shell.php). The attacker uploads this file through the AVideo ImageGallery feature, which validates the JPEG MIME type based on the initial bytes but saves the file with the attacker-controlled .php extension in a web-accessible directory. The attacker then requests the uploaded PHP file via HTTP, causing the web server to execute the embedded PHP code and granting the attacker a remote shell with the privileges of the web server process, enabling full system compromise.