CVE-2023-49715 is a medium severity (CVSS 4.3) unrestricted PHP file upload in the import.json.php temporary copy function of WWBN AVideo. Talos says the vendor patched it in December 2023 but names no version. Update to a current build and review upload permissions.
What's affected
The record names WWBN AVideo dev master commit 15fed957fb. The weakness is CWE-434 (unrestricted upload of a file with a dangerous type). The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, which needs a low privilege account.
The description says the flaw can lead to arbitrary code execution when chained with a local file inclusion bug. Talos adds that exploitation needs upload permission, and the companion issue is TALOS-2023-1886. That chaining is why a 4.3 score can still deserve attention: the base score covers this bug alone.
Fixed versions: Talos reports the vendor was told on 2023-12-14 and released a patch on 2023-12-15, but the page names no fixed commit or release. Check the AVideo repository and release notes to confirm your build includes the change.
How to check if you're exposed
Find the AVideo version or commit you run. On a git based install:
cd /path/to/AVideo
git log -1 --format=%H%n%cd
Compare the date with the 15 December 2023 patch. A deployment older than that is suspect. Also review which accounts hold upload permission, and look in web writable folders for unexpected PHP files. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Identify every AVideo instance, including test servers, and its commit or release.
- Update to a current release that postdates the December 2023 fix. Confirm in the project history.
- Audit users with upload rights and remove the permission where it is not needed.
- Search upload and temporary directories for PHP files that should not be there.
- Configure the web server so uploaded content cannot execute as PHP.
Why it matters
Unrestricted upload bugs let a user store a file type the application should refuse. If the server can run that file, the upload becomes code execution. Here a second bug is needed to reach the stored file, which explains the lower score.
Chains like this are why vulnerability triage should read the description and not only the number. Two modest flaws together can equal a serious one. This CVE is not on the CISA KEV list.
Quick check
Does this need a login?
The vector shows low privileges, and Talos says upload permission is required.
Is a fixed release named?
No. Talos names only the vulnerable commit and a patch date, so verify against the project history.
Sources
Last reviewed: 19 October 2026.
