What is the CVSS score of EUVD-2026-14492?

EUVD-2026-14492 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-14492?

WWBN AVideo installations (versions ≤26.0) face a critical database compromise risk through an authenticated administrator vulnerability that can be exploited remotely without user interaction via…

How to fix or mitigate EUVD-2026-14492?

Within 24 hours: Inventory all WWBN AVideo deployments and document versions; implement network-level access restrictions to pluginRunDatabaseScript.json.php endpoint. Within 7 days: Apply compensating controls (WAF rules, disable plugin database script features if non-essential, enforce admin IP whitelisting, conduct admin session audit). Within 30 days: Establish timeline for migration to patched version once available, or evaluate alternative video platform solutions if vendor patch timeline is uncertain.

PHP EUVD-2026-14492

| CVE-2026-33681 HIGH

Path Traversal (CWE-22)

2026-03-23 GitHub_M

GHSA-3hwv-x8g3-9qpr

Path Traversal PHP CSRF

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 19:00 euvd

EUVD-2026-14492

Analysis Generated

Mar 23, 2026 - 19:00 vuln.today

CVE Published

Mar 23, 2026 - 18:39 nvd

HIGH 7.2

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the objects/pluginRunDatabaseScript.json.php endpoint accepts a name parameter via POST and passes it to Plugin::getDatabaseFileName() without any path traversal sanitization. This allows an authenticated admin (or an attacker via CSRF) to traverse outside the plugin directory and execute the contents of any install/install.sql file on the filesystem as raw SQL queries against the application database. Commit 81b591c509835505cb9f298aa1162ac64c4152cb contains a patch.

AnalysisAI

WWBN AVideo, an open source video platform, contains a critical path traversal vulnerability in the pluginRunDatabaseScript.json.php endpoint that allows authenticated administrators to execute arbitrary SQL queries against the application database. Versions up to and including 26.0 are affected. The vulnerability can also be exploited via CSRF attacks against authenticated admin sessions, enabling unauthenticated attackers to achieve remote code execution or complete database compromise.

Technical ContextAI

The vulnerability affects WWBN AVideo (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), a PHP-based open source video platform. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The vulnerable endpoint objects/pluginRunDatabaseScript.json.php accepts a 'name' parameter via POST request and passes it directly to Plugin::getDatabaseFileName() without sanitizing directory traversal sequences like '../'. This allows an attacker to reference any install.sql file on the filesystem, which is then executed as raw SQL queries against the application database. The combination of path traversal and SQL execution creates a severe security issue, as install.sql files typically contain arbitrary SQL statements including DDL and DML commands that are executed with full database privileges.

RemediationAI

Upgrade to a version of WWBN AVideo that includes commit 81b591c509835505cb9f298aa1162ac64c4152cb or later, which contains the path traversal sanitization patch. The fix details are available at https://github.com/WWBN/AVideo/commit/81b591c509835505cb9f298aa1162ac64c4152cb and the complete security advisory is at https://github.com/WWBN/AVideo/security/advisories/GHSA-3hwv-x8g3-9qpr. Until patching is completed, implement compensating controls including restricting admin panel access to trusted IP addresses only, enforcing strong CSRF tokens on all admin actions, and monitoring database query logs for suspicious SQL execution patterns. Consider temporarily disabling the plugin installation/management functionality if not actively required.