CVE-2026-33681 | WWBN AVideo up to 26.0 Parameter pluginRunDatabaseScript.json.php getDatabaseFileName path traversal

A vulnerability labeled as critical has been found in WWBN AVideo up to 26.0. Affected by this vulnerability is the function Plugin::getDatabaseFileName of the file objects/pluginRunDatabaseScript.json.php of the component Parameter Handler. The manipulation of the argument Name results in path traversal.

This vulnerability is reported as CVE-2026-33681. The attack can be launched remotely. No exploit exists.

It is advisable to implement a patch to correct this issue.