CVE-2026-33647 AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the ImageGallery::saveFile method validates uploaded file content using finfo MIME type detection but derives the saved filename extension from the user-supplied original filename without an allowlist check. An...

CVE-2026-33647

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the "ImageGallery::saveFile" method validates uploaded file content using "finfo" MIME type detection but derives the saved filename extension from the user-supplied original filename without an allowlist check. A...

CVE-2026-33647: Unrestricted Upload of File with Dangerous Type

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the ImageGallery::saveFile method validates uploaded file content using finfo MIME type detection but derives the saved filename extension from the user-supplied original filename without an allowlist check. An...