CVE-2026-126804: WWBN AVideo 12.4 through 29.7.1 Path Traversal File Deletion via deleteImage.json.php
WWBN AVideo 12.4 through 29.7.1 contains a path traversal vulnerability in the ADs plugin deleteImage.json.php that allows authenticated users with custom ads to delete arbitrary files. Attackers can set the unvalidated isregularuser parameter to another user's id or ../ sequences to delete other users' ads or files like videos/configuration.php, taking the site offline and re-exposing the installer.
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have custom ads. The issue is in the ADs plugin endpoint deleteImage.json.php.
What is the practical impact of a successful exploit?
An attacker can delete other users' ads or arbitrary files by manipulating the is_regular_user parameter. Deleting videos/configuration.php can take the site offline and re-expose the installer.
What input manipulation enables deletion outside the intended user scope?
The is_regular_user parameter is not validated. An attacker can set it to another user's ID or use ../ path traversal sequences.
How can I determine whether my deployment is in the affected range?
WWBN AVideo versions 12.4 through 29.7.1 are affected. Review whether the ADs plugin and its deleteImage.json.php endpoint are present, especially where users can create custom ads.