GHSA-g69x-xc9q-2g2v

GHSA-83xq-8jxj-4rxm (CVE-2026-33493) reported that objects/import.json.php lets any user with upload permission (1) steal another user's private video by importing it into their own account, (2) read the video's .txt/.html/.htm sidecar, and (3) delete the video file. The fix in commit e110ff542a added a realpath() prefix check, so fileURI now has to resolve inside videos/. But every user's media is stored inside videos/ (videos//*.mp4). The check does not ask whether the target folder belongs to a video the caller owns or can edit. So the advisory's own Step 1 (theft) and Step 3 (deletion) PoCs still work unchanged on current master. The fix only blocked the "outside videos/" variant.

The script below reads objects/import.json.php from the repository at run time. It slices the real code verbatim, from the .mp4 regex check up to the require_once ... upload.php hand-off, and eval()s it against a temporary AVideo root. Nothing in the guarded code is paraphrased or stubbed.