Avideo EUVD-2026-14504

Authenticated user with upload privileges on WWBN AVideo versions up to 26.0. Attacker calls downloadVideoFromDownloadURL() with a crafted remote PHP file URL and invalid resolution parameter, triggering early die() before cleanup, leaving executable PHP in web-accessible videos/cache/tmpFile/ directory.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates this is a network-exploitable vulnerability with low attack complexity requiring only low-privilege authentication, making it readily exploitable by authenticated users. The combination of remote code execution capability and low complexity suggests high real-world risk despite requiring authentication. While no EPSS score or KEV status is provided in the available data, the presence of a specific GitHub security advisory (GHSA-8wf4-c4x3-h952) and a committed patch (6da79b43484099a0b660d1544a63c07b633ed3a2) indicates the vendor has confirmed and addressed this vulnerability. The technical impact is critical (complete system compromise possible), and the attack is likely automatable once an attacker has authenticated access. For organizations running AVideo with multiple user accounts or public registration, this should be treated as a high-priority patch candidate. The primary limiting factor is the PR:L requirement, which reduces exposure compared to unauthenticated RCE vulnerabilities.

An authenticated attacker with low-privilege access to an AVideo instance crafts a malicious request to downloadVideoFromDownloadURL() pointing to a remote server hosting a PHP webshell with a .php extension. By simultaneously providing an invalid resolution parameter, the attacker triggers the forbiddenPage() error path, causing the function to terminate before cleanup occurs while the malicious PHP file remains persistently stored in the web-accessible videos/cache/tmpFile/ directory. The attacker then directly accesses the uploaded webshell via HTTP, achieving arbitrary code execution on the server with the privileges of the web server process, enabling data exfiltration, lateral movement, or complete system compromise.