A critical flaw in WWBN AVideo lets unauthenticated remote attackers write arbitrary files to the server via HTTP PUT, opening paths to denial of service and remote code execution.
What Is It
CVE-2026-72748 is an unauthenticated arbitrary file write vulnerability in AVideo's aVideoEncoderChunk.json.php endpoint. The endpoint is missing an authentication check (CWE-306: Missing Authentication for Critical Function), allowing remote attackers to write up to 4 GB of arbitrary content to the server filesystem using HTTP PUT requests; no credentials, no user interaction, low attack complexity.
The CVE was published 2026-08-11 and assigned by VulnCheck. It carries a CVSS v3.1 base score of 9.1 (Critical): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, reflecting high integrity and availability impact. A secondary CVSS v4.0 score of 6.9 (Medium) was also supplied by the same source.
Why It Matters
Three distinct impact paths are described in the advisory data:
- Denial of service: an attacker can exhaust disk space by writing large files repeatedly.
- Encoding pipeline poisoning: arbitrary content can be planted where AVideo's video encoder expects it.
- Remote code execution: the file write can be chained with a local file inclusion to execute attacker-controlled code.
Because no authentication is required and the attack is over the network, an internet-reachable AVideo 29.0 instance that serves the affected endpoint is likely reachable by an unauthenticated attacker. Deployments that restrict access to the encoder endpoint at the network or web-server layer may not be exposed.
What's Vulnerable
- Vendor: WWBN
- Product: AVideo
- Affected version: 29.0 (default status for other versions listed as unaffected)
No CPE match data is present in the NVD record at this time.
Patch Status
A fix commit is available in the upstream WWBN/AVideo repository (1b55a9b3c4911d2f31594ce2e60566c70c6b95e8), and the project has published GitHub Security Advisory GHSA-v7p7-jccx-h37c. Operators running AVideo 29.0 should apply the upstream fix.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; no confirmed active exploitation and no federal required-action deadline is associated with it. NVD status is "Received," so analysis and enrichment are still pending.