A critical flaw in WWBN AVideo's notify.ffmpeg.json.php endpoint allows unauthenticated attackers to write files to attacker-chosen paths within the application root and its subdirectories, by replaying any previously issued ciphertext as an authentication token.
What Is It
CVE-2026-86189 is a path traversal vulnerability (CWE-73: External Control of File Name or Path) in the open-source AVideo video platform. The endpoint notify.ffmpeg.json.php accepts a caller-chosen path in the avideoRelativePath parameter and uses it to write files without validating that the resulting destination stays within the intended directory.
The authentication layer that should gate this endpoint is broken in a way that makes exploitation trivial. The notifyCode token is decrypted but never validated, so an attacker can replay any previously issued ciphertext to pass the check. The result is a fully unauthenticated primitive for writing files into the application root and its subdirectories.
Why It Matters
The CVSS v3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS v4.0 score is 9.3 (CRITICAL). Every exploitability factor is at worst case: network attack vector, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability.
A file write into the web root of a PHP application is a direct path to remote code execution; an attacker who can drop a .php file into a directory the web server serves can generally execute it. AVideo is a platform for serving video to viewers, so many deployments are likely to be exposed to the internet; operators of instances that are reachable from untrusted networks should treat this as urgent.
What's Vulnerable
- Vendor: WWBN
- Product: AVideo
- Affected versions: all versions up to and including 29.0 (default status: unaffected for versions outside this range)
Patch Status
The supplied source material does not include a CISA KEV entry for this CVE, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline at this time. The NVD record is in Received status (published 2026-09-05, source: VulnCheck), meaning NVD analysis is still pending. No specific fixed version is stated in the supplied data; consult the vendor's GitHub security advisory below for remediation guidance.
Sources
- NVD, CVE-2026-86189 (record published 2026-09-05, source
[email protected]) - WWBN AVideo GitHub Security Advisory GHSA-cprx-fggj-7vpq; https://github.com/WWBN/AVideo/security/advisories/GHSA-cprx-fggj-7vpq
- VulnCheck Advisory, WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php, https://www.vulncheck.com/advisories/wwbn-avideo-unauthenticated-path-traversal-via-notify-ffmpeg-json-php