AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
Date: 2026-03
Affected: composer/wwbn/avideo
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33681
CWE: CWE-22
CVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

## Summary The `objects/pluginRunDatabaseScript.json.php` endpoint accepts a `name` parameter via POST and passes it to `Plugin::getDatabaseFileName()` without any path traversal sanitization. This allows an authenticated admin (or an attacker via CSRF) to traverse outside the plugin directory and execute the contents of any `install/install.sql` file on the filesystem as raw SQL queries against the application database. ## Details The vulnerable data flow: **1. Entry point** — `objects/pluginRunDatabaseScript.json.php:21`: ```php $fileName = Plugin::getDatabaseFileName($_POST['name']); ``` **2. "Sanitization"** — `objects/plugin.php:343-354`: ```php public static function getDatabaseFileName($pluginName) { global $global; $pluginName = AVideoPlugin::fixName($pluginName); // line 347 — no-op $dir = $global['systemRootPath'] . "plugin"; $filename = $dir . DIRECTORY_SEPARATOR . $pluginName . DIRECTORY_SEPARATOR . "install" . DIRECTORY_SEPARATOR . "install.sql"; if (!file_exists($filename)) { return false; } return $filename; } ``` **3. The "fix"** — `plugin/AVideoPlugin.php:3184-3190`: ```php public static function fixName($name) { if ($name === 'Programs') { return 'PlayLists'; } return $name; // Returns input unchanged for all other values } ``` **4. SQL execution** — `objects/pluginRunDatabaseScript.json.php:24-36`: ```php $lines = file($fileName); foreach ($lines as $line) { // ... if (!$global['mysqli


Mitigations:

Architectural layers (MAESTRO):