GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
GHSA-v8jw-8w5p-23g3critical9.3

AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

Check your stack

The advisory, in context

Summary

An authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality.

The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution.

Vulnerability Type

  • Remote Code Execution (RCE)
  • CWE-434: Unrestricted Upload of File with Dangerous Type

Affected Versions

  • All versions up to and including 22.x.

Fixed Version

  • A fix is expected to be released in version 23.

Root Cause

The system validated only the ZIP extension of uploaded plugin packages but did not enforce a strict allowlist of file types within the archive. Extracted files were placed directly in a web-accessible directory without preventing execution of server-side scripts.

Impact

An authenticated administrator could execute arbitrary code on the server, resulting in full system compromise, including:

  • Confidentiality loss
  • Integrity loss
  • Availability impact

Remediation

Upgrade immediately to AVideo version 23 or later.

Version 23 introduces improved validation and secure handling of plugin extraction.

Workarounds

If upgrade is not immediately possible:

  • Disable plugin upload/import functionality.
  • Configure the web server to prevent execution of PHP files inside plugin upload directories.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

wwbn/avideo Packagist
Versions

All releases from the beginning; no upper bound recorded

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

References