CVE-2026-33513 - AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

ANALYST: BIVASH KUMAR NAYAK (CHIEF SECURITY ARCHITECT) • PUBLISHED: Tuesday, 24 March 2026

TLP:GREEN // CDB-GOC CVE INTELLIGENCE ADVISORY // SENTINEL APEX v30.0

Report ID: CDB-CVE-2026-0323-A900B1 | Classification: TLP:GREEN | Published: 2026-03-23 20:30:51 UTC

Prepared By: CyberDudeBivash Global Operations Center (GOC) | Report Type: CVE Intelligence Advisory — NVD-Verified | Distribution: SOC / Enterprise / Executive

HIGH TLP:GREEN CVSS 8.6 ✓ NVD-VERIFIED ⚠️ Vulnerability Disclosure

CYBERDUDEBIVASH SENTINEL APEX™ // CVE THREAT INTELLIGENCE ADVISORY

CVE-2026-33513: WWBN AVideo is an open source video platform

NVD-Verified Intelligence Advisory — CyberDudeBivash Sentinel APEX™ | All technical claims verified against NIST NVD, CERT/CC, and official vendor references.

1. EXECUTIVE SUMMARY

✓ VERIFIED INTELLIGENCE

CVE-2026-33513 is a HIGH-severity vulnerability published on March 23, 2026 with a CVSS 3.1 base score of 8.6/10.0. The vulnerability is classified under CWE-22, CWE-98 (Path Traversal; Weakness Classification CWE-98). Web-facing application surfaces are in scope.

Vulnerability Summary (NVD-Verified)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., `view/about.php`), and it *can* escalate to RCE if an attacker can place or control a PHP file elsewhere in the tree. As of time of publication, no patched versions are available.

Key Metrics at a Glance

Attribute	Value	Source
CVE ID	CVE-2026-33513	NIST NVD
CVSS Base Score	8.6/10.0 (HIGH)	NVD CVSS 3.1
Weakness Class	CWE-22, CWE-98	NVD / MITRE CWE
NVD Status	Received	NIST NVD
Published	March 23, 2026	NIST NVD
Last Modified	March 23, 2026	NIST NVD
Intelligence Confidence	High — NVD Analyzed status, researcher-attributed	CDB-GOC Assessment

Business Risk Implications: Organizations and individuals deploying the affected software version(s) are the primary affected population. Security teams should consult the NVD entry and vendor advisory links in the References section for authoritative remediation guidance.

2. VULNERABILITY OVERVIEW

CVSS Vector Analysis

CVSS 3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Metric	Interpretation
Attack Vector	The vulnerability is exploitable remotely over a network without requiring physical access or local presence.
Attack Complexity	No specialized conditions are required — exploitation can be automated and repeated reliably.
Privileges Required	No authentication or prior access is required to exploit this vulnerability.
User Interaction	Exploitation does not require any user interaction — attacks can be fully automated.
Confidentiality Impact	Complete impact — full disclosure or modification possible
Integrity Impact	Limited impact — partial disclosure or modification possible
Availability Impact	Limited impact — partial disclosure or modification possible

Weakness Classification

✓ MITRE CWE / NVD VERIFIED

CWE ID	Name	Class
CWE-22	Path Traversal	Path Traversal
CWE-98	Weakness Classification CWE-98	Software Weakness

CWE-22 — Technical Context

The software uses external input to construct a pathname intended to identify a file, but does not neutralize sequences that can resolve to a location outside the intended directory.

OWASP Category: A01:2021 – Broken Access Control

CWE-98 — Technical Context

This vulnerability is classified under CWE-98 by NVD/MITRE. Security teams should consult the MITRE CWE database for complete technical details on this weakness class.

OWASP Category: Refer to OWASP Top 10 for applicable category

3. VERIFIED TECHNICAL DETAILS

✓ NVD AUTHORITATIVE DESCRIPTION

NVD Official Description:

Source: NIST National Vulnerability Database | Status: Received | Last Modified: March 23, 2026

Affected Products and Versions

✓ NVD DESCRIPTION DERIVED

Affected versions are described in the official NVD entry: CVE-2026-33513. Consult the NVD reference and vendor advisory links in Section 9 for the authoritative affected version list.

From NVD description: WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be in...

Vulnerability Mechanism (From Verified Description)

The following technical analysis is derived exclusively from the NVD description, associated CWE classification (CWE-22, CWE-98), and CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). No additional attack scenarios have been extrapolated beyond the verified vulnerability scope.

CVSS Exploitability Profile

✓ NVD CVSS 3.1 VERIFIED

Parameter	Value
Base Score	8.6 (HIGH)
Exploitability Score	3.9/3.9
Impact Score	4.7/5.9
CVSS Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

⚠ Scope Boundary: The technical analysis above is confined to the verified vulnerability scope as disclosed in the NVD entry. Claims regarding malware, firmware compromise, process injection, credential interception, OTP theft, supply chain attacks, or any attack technique not directly described in the NVD entry are outside the verified scope of this vulnerability and are not asserted in this report.

4. RESEARCHER ATTRIBUTION

Researcher attribution data is not available in the NVD entry for CVE-2026-33513 at the time of this report's generation. CYBERDUDEBIVASH Sentinel APEX™ will update this section if attribution information becomes available via NVD, CERT/CC, or researcher public disclosure.

5. SECURITY IMPLICATIONS

ℹ SECURITY IMPLICATIONS — Derived from Verified Facts

The following implications follow logically from the verified vulnerability facts. These represent the realistic security consequences of the vulnerability as disclosed. They are not extrapolated attack scenarios.

Direct Security Consequences

Path Traversal: The software uses external input to construct a pathname intended to identify a file, but does not neutralize sequences that can resolve to a location
Weakness Classification CWE-98: This vulnerability is classified under CWE-98 by NVD/MITRE. Security teams should consult the MITRE CWE database for complete technical details on thi

Attack Surface Assessment

The vulnerability is exploitable remotely over a network without requiring physical access or local presence. No authentication or prior access is required to exploit this vulnerability. Exploitation does not require any user interaction — attacks can be fully automated.

The CVSS 3.1 base score of 8.6 (HIGH) reflects the vulnerability is exploitable remotely over a network without requiring physical access or local presence. no authentication or prior access is required to exploit this vulnerability. and exploitation does not require any user interaction — attacks can be fully automated.. Security teams should treat patch deployment as a priority action.

Affected Population

Based on the verified technical scope, the following user populations are affected:

Organizations running affected versions of the software described in the NVD entry
Users or administrators with access to the affected component or endpoint
Systems where the affected software is internet-facing or accessible by untrusted users

Consult the NVD entry and vendor advisory for the definitive list of affected versions. Systems that have applied the vendor patch or mitigation are not affected.

6. THREAT INTELLIGENCE CONTEXT

⚠ THREAT INTELLIGENCE HYPOTHESIS — Analytical Speculation

The scenarios below are analytical hypotheses derived from the vulnerability class, CVSS characteristics, and threat landscape context. They are not confirmed exploitation reports. They represent plausible — but unverified — threat scenarios that security teams may wish to consider in their risk modeling.

Potential Abuse Scenario: Based on the CVSS vector and CWE classification, threat actors aware of this vulnerability may attempt exploitation in targeted attack chains. Organizations should monitor for indicators consistent with the exploitation techniques mapped in Section 7.

These scenarios are analytical hypotheses based on the vulnerability class and CVSS characteristics. No active exploitation campaigns have been confirmed in public reporting at the time of this advisory.

Note: The vulnerability itself does not directly implement malware functionality. However, similar technical weaknesses can sometimes contribute to broader attack chains when combined with other techniques. Any such scenarios are speculative and clearly labeled as hypotheses in this advisory.

7. DETECTION OPPORTUNITIES

Detection strategies should be tailored to the vulnerability class (CWE-22, CWE-98). Consult the MITRE ATT&CK techniques mapped in Section 7 for specific detection opportunities aligned to the threat model.

MITRE ATT&CK Technique Mapping (CWE-Verified)

No direct MITRE ATT&CK mapping established for this CWE combination. Consult the NVD entry for additional context.

Sigma Rule (SIEM-Agnostic)

Deploy to Microsoft Sentinel, Splunk, Elastic, or any Sigma-compatible platform. Rule scope is aligned to the actual vulnerability class, not a generic campaign template.

title: Vulnerability Exploitation Attempt — CVE-2026-33513
id: cdb-cve_2026_33513-sigma-001
status: experimental
description: >
  Monitors for indicators consistent with exploitation of CVE-2026-33513.
  WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`AP...
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-33513
author: CyberDudeBivash Sentinel APEX™ GOC
date: 2026/03/23
tags:
  - attack.initial_access
  - attack.t1190
  - cve.cve_2026_33513
logsource:
  category: application
detection:
  keywords:
    - 'CVE-2026-33513'
  condition: keywords
falsepositives:
  - Vulnerability scanner activity
  - Security research tools
level: medium

YARA Rule (Endpoint / Binary Analysis)

Scoped to the vulnerability class (CWE-22, CWE-98). Apply to application binaries and memory forensics relevant to the affected component.

/*
  YARA Rule: CVE-2026-33513
  Description: Generic vulnerability class detection for CVE-2026-33513 (CWE-22, CWE-98)
  Author: CyberDudeBivash Sentinel APEX™ GOC
  Date: 2026-03-23
  Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-33513
*/
rule CVE_2026_33513_generic_vuln_indicator {
    meta:
        cve = "CVE-2026-33513"
        cwe = "CWE-22, CWE-98"
        description = "Vulnerability artifact indicator for CVE-2026-33513"
        author = "CyberDudeBivash Sentinel APEX v44.0"
        date = "2026-03-23"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-33513"
        severity = "REVIEW"
        context = "Vulnerability detection — consult NVD for precise scope"

    strings:
        $cve_ref = "CVE-2026-33513" ascii nocase
        $nvd_ref = "nvd.nist.gov" ascii

    condition:
        any of ($*)
}

8. DEFENSIVE RECOMMENDATIONS

The following recommendations are scoped to the verified vulnerability and its actual security impact. Generic security hardening guidance is provided where relevant but clearly distinguished from vulnerability-specific actions.

Vulnerability-Specific Actions (Primary)

Immediate — Apply Vendor Patches: Deploy all patches referenced in the NVD entry for CVE-2026-33513.
Verify Patch Deployment: Confirm patched versions are deployed across all affected systems using your vulnerability management platform (Qualys, Tenable, Rapid7).
Monitor for Exploitation: Enable enhanced monitoring for exploitation indicators relevant to the CVSS attack vector (NETWORK) and CWE class (CWE-22, CWE-98).

General Hardening (Secondary)

Asset Inventory: Maintain an up-to-date inventory of all deployed application versions to enable rapid identification of exposure when new CVEs are published.
Vulnerability Management Program: Cross-reference CVE-2026-33513 against your vulnerability management platform and CISA's Known Exploited Vulnerabilities (KEV) catalog. Adjust patch priority based on your organization's threat exposure.
Patch Testing Pipeline: Establish a tested patch deployment workflow that enables critical patches to reach production within 24–72 hours of vendor release.

9. REFERENCES

✓ AUTHORITATIVE SOURCES

Source	Reference URL	Type
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-33513	Primary — NVD Official Entry
1	https://github.com/WWBN/AVideo/security/advisories/GHSA-8fw8-q79c-fp9m

All references above are sourced from the NIST National Vulnerability Database entry for CVE-2026-33513. Security teams should consult these primary sources directly for the most current information.

10. INTELLIGENCE CONFIDENCE ASSESSMENT

Signal	Factor	Confidence	Notes
✓	CVSS 3.1 Score Available	HIGH	Quantitative risk metric confirmed
✓	CWE Classification Confirmed	HIGH	Weakness class verified by NVD
✓	1 Reference(s) Available	HIGH	Vendor and third-party sources linked in NVD
ℹ	CISA KEV Status	N/A	Not confirmed in CISA Known Exploited Vulnerabilities catalog at time of report generation
→	OVERALL INTELLIGENCE CONFIDENCE	MEDIUM	Partial NVD verification. Consult vendor advisories for additional confirmation.

Methodology Transparency

This report was generated by the CYBERDUDEBIVASH Sentinel APEX™ CVE-Verified Report Engine v44.0. All technical claims are sourced exclusively from: (1) the NIST National Vulnerability Database REST API v2 (CVE-2026-33513), (2) CWE/MITRE classification data, and (3) CVSS vector mechanical interpretation. No keyword-driven narrative templates, machine learning content generation, or speculative attack chain injection were used in producing the verified sections (Sections 1–5) of this report.

Section 6 (Threat Intelligence Context) is explicitly labeled as analytical hypothesis and is clearly separated from verified intelligence throughout the report.

CYBERDUDEBIVASH SENTINEL APEX™

Global Threat Intelligence Platform

Report ID: CDB-CVE-2026-0323-A900B1 | Generated: 2026-03-23 20:30:51 UTC

This advisory is produced for defensive intelligence purposes. All claims verified against NIST NVD. Distribution: TLP:CLEAR.