CVE-2026-28502·PHP vulnerability

Affected versions

How to fix this CVE

Upgrade PHP to version 24.0 or later to patch the authenticated remote code execution vulnerability in the plugin upload mechanism. This update implements strict validation of ZIP archive contents before extraction, preventing malicious PHP files from being written to web-accessible directories. Organizations running older versions should prioritize this update, particularly if administrator accounts are shared or have weaker access controls.

sudo dnf update php php-cli php-fpm php-mysql php-curl php-gd php-mbstring php-xml php-zip

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /plugin\.php|POST /upload\.php|POST /import\.php with Content-Type: multipart/form-data containing .zip file followed by HTTP 200 response and subsequent PHP file writes to /plugins/ directory, or file extraction errors in error logs containing plugin directory paths

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Restrict file uploads to authenticated administrative users only; implement whitelist-based file type validation rejecting all files with executable extensions (.php, .phtml, .php3, .php4, .php5, .phps, .phar) in ZIP archives; enforce Content-Disposition headers and block direct execution of files in upload directories via .htaccess or nginx configuration

How to check if you are affected

1. Check the installed PHP version: php -v
2. Verify AVideo installation path: find / -name 'AVideo' -type d 2>/dev/null | head -5
3. Review plugin directory permissions: ls -la /path/to/AVideo/plugins/ | grep -E '^-rwx'
4. Search web server access logs for suspicious POST requests to plugin upload endpoints: grep -i 'plugin.*upload\|import.*zip' /var/log/apache2/access.log /var/log/nginx/access.log 2>/dev/null
5. Examine plugin directory for recently modified PHP files: find /path/to/AVideo/plugins/ -name '*.php' -type f -mtime -7 -ls
6. Confirm patch installation: php -r 'echo phpversion();' and verify >= 24.0

FAQ

Related PHP CVEs

References

• https://github.com/WWBN/AVideo/commit/b739aeeb9ce34aed9961d2c155d597810f8229db
• https://github.com/WWBN/AVideo/releases/tag/24.0
• https://github.com/WWBN/AVideo/security/advisories/GHSA-v8jw-8w5p-23g3