Is CVE-2026-33513 actively exploited?

No active exploitation of CVE-2026-33513 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33513 be exploited remotely?

Yes. CVE-2026-33513 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33513?

CVE-2026-33513 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-33513

HIGH

CVE-2026-33513

CWE-22Published: March 23, 2026· Updated: Mar 25, 2026

7.5

CVSS v3.1

EPSS:0.15%probability of exploitation in 30 daysPercentile:36.1th

Official Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., `view/about.php`), and it *can* escalate to RCE if an attacker can place or control a PHP file elsewhere in the tree. As of time of publication, no patched versions are available.

NVD Source

Technical Analysis

CVE-2026-33513 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.