CVE-2026-124424: WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.php

Published Nov 8, 2026

Updated

WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized response[lang] parameter. Attackers can send a type=translation request with a crafted lang value to plant attacker-controlled content in the webroot or overwrite other users' subtitle files.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs any valid AI token. Exploitation does not require user interaction and can be performed remotely.

What request parameters are involved in exploitation?

The attacker sends a request to plugin/AI/receiveAsync.json.php with type set to translation and a crafted lang value containing traversal sequences. The unsanitized response[lang] value controls where the .vtt file is written.

What can an attacker change?

An attacker can write attacker-controlled .vtt files in the webroot or overwrite other users' subtitle files. The stated impact is integrity compromise and limited availability impact.

CVE-2026-124424: WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.php

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What request parameters are involved in exploitation?

What can an attacker change?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What request parameters are involved in exploitation?

What can an attacker change?