CVE-2026-33483

The connected advisory details an unauthenticated, public endpoint in AVideo: objects/aVideoEncoderChunk.json.php, exposed at /aVideoEncoderChunk.json, that accepts POST data without authentication or input size limits. It writes the request body to persistent temp files (e.g., /tmp/YTPChunk_*) w...