Skip to content
Threat Feed
Subscribe

Tag

Polyglot

1 brief RSS
critical advisory

AVideo Remote Code Execution via Polyglot File Upload (CVE-2026-33647)

AVideo versions up to 26.0 are vulnerable to remote code execution (CVE-2026-33647) due to insufficient file validation in the `ImageGallery::saveFile()` method, allowing attackers to upload polyglot files with a `.php` extension to achieve code execution.

AVideo CVE-2026-33647 RCE File Upload Polyglot
2r 1t