CVE-2026-33354

Packagist/wwbn/avideo CVE-2026-33354: high 7.6, EPSS 0.36%

AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-4jw9-5hrc-m4j6
• https://github.com/WWBN/AVideo/security/advisories/GHSA-4jw9-5hrc-m4j6
• https://nvd.nist.gov/vuln/detail/CVE-2026-33354
• https://github.com/WWBN/AVideo/commit/59bbd601a3f65a5b18c1d9e4eb11471c0a59214f
• https://github.com/WWBN/AVideo

CVE-2026-33354 · published 2026-03-19T19:34:06Z · modified 2026-03-25T19:48:02.662142Z · JSON