CVE-2026-86189: WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs network access to the affected AVideo instance and a previously issued ciphertext that can be replayed as a notifyCode token. No authentication or user interaction is required.
Which systems are realistically exposed?
AVideo instances where notify.ffmpeg.json.php is reachable over the network are exposed to unauthenticated exploitation, provided an attacker can obtain a previously issued notifyCode ciphertext. The available information does not identify affected versions or whether any particular deployment configuration prevents exposure.
What can an attacker do after exploitation?
An attacker can supply a caller-chosen avideoRelativePath and write files to arbitrary locations within the application root and its subdirectories. The reported impact includes compromise of confidentiality, integrity, and availability.
How can defenders tell whether exploitation may have occurred?
Review requests to notify.ffmpeg.json.php for unexpected or traversal-style avideoRelativePath values and replayed notifyCode values. Also inspect the application root and subdirectories for unexpected newly created or modified files.