{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"26.0"}],"component":"wwbn/avideo","cve_ids":["CVE-2026-33647"],"ecosystem":"Packagist","epss":0.00651,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-wxjw-phj6-g75w","id":"tcs_01M5KFAFNZBP1GCFTEYECY073M","modified_at":"2026-03-25T18:11:20.558817Z","published_at":"2026-03-25T17:45:40Z","references":["https://osv.dev/vulnerability/GHSA-wxjw-phj6-g75w","https://github.com/WWBN/AVideo/security/advisories/GHSA-wxjw-phj6-g75w","https://nvd.nist.gov/vuln/detail/CVE-2026-33647","https://github.com/WWBN/AVideo/commit/345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae","https://github.com/WWBN/AVideo"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-wxjw-phj6-g75w","url":"https://osv.dev/vulnerability/GHSA-wxjw-phj6-g75w"}],"summary":"AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload"}