CVE-2026-33770: AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

March 26, 2026 (updated March 27, 2026)

The fixCleanTitle() static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $clean_title and $id into the query string without using prepared statements or parameterized queries. An attacker who can trigger category creation or renaming with a crafted title value can inject arbitrary SQL.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/commit/994cc2b3d802b819e07e6088338e8bf4e484aae4
github.com/WWBN/AVideo/security/advisories/GHSA-584p-rpvq-35vf
github.com/advisories/GHSA-584p-rpvq-35vf
nvd.nist.gov/vuln/detail/CVE-2026-33770

Code Behaviors & Features

Detect and mitigate CVE-2026-33770 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →