Is CVE-2026-124424 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124424 being exploited in the wild.

How severe is CVE-2026-124424?

High severity, with a CVSS score of 7.1, published 8 November 2026.

How is CVE-2026-124424 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-124424?

Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124424: WWBN AVideo path traversal in AI plugin receiveAsync.json.php

Q: Is there a fix for CVE-2026-124424?

No fixed version is recorded yet. Disable the AI plugin if not in use. Validate the response[lang] parameter against a strict whitelist (e.g. /^[a-z0-9_-]{2,8}$/i) and reject any traversal sequences before file operations, or restrict the web server process to the minimum necessary file write permissions. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

CVE-2026-124424 · Severity: high · CVSS 7.1 · Published 2026-11-08

WWBN AVideo is a self-hosted video platform that includes an AI plugin for automatic transcription and translation. An attacker with any valid AI token can exploit a path traversal flaw to write malicious .vtt subtitle files to arbitrary locations on the web server, potentially serving malicious content to users or overwriting legitimate subtitle files. This requires only a valid but non-expiring AI token that is easy to obtain.

Technologies: WWBN AVideo. Vendors: WWBN.

Quick answers

Is CVE-2026-124424 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124424 being exploited in the wild.
How severe is CVE-2026-124424?: High severity, with a CVSS score of 7.1, published 8 November 2026.
Which products and versions are affected?: WWBN AVideo <= 29.7.0.
Is there a fix for CVE-2026-124424?: No fixed version is recorded yet. Disable the AI plugin if not in use. Validate the response[lang] parameter against a strict whitelist (e.g. /^[a-z0-9_-]{2,8}$/i) and reject any traversal sequences before file operations, or restrict the web server process to the minimum necessary file write permissions.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-124424 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-124424?: Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable the AI plugin if not in use. Validate the response[lang] parameter against a strict whitelist (e.g. /^[a-z0-9_-]{2,8}$/i) and reject any traversal sequences before file operations, or restrict the web server process to the minimum necessary file write permissions.</anigation> </invoke>

Technical details

The vulnerability exists in plugin/AI/receiveAsync.json.php where the user-controlled response[lang] parameter is passed unsanitized into Ai_transcribe_responses::getVTTPaths(), allowing directory traversal sequences (../) to escape the intended videos directory. The endpoint accepts requests from any holder of a valid AI token without expiry validation or ownership checks, and PHP's path resolution lexically processes the traversal sequences, enabling writes to any *.vtt file in locations writable by the web server process (webroot, /tmp, etc.) with fully attacker-controlled content.

Affected products

WWBN AVideo <= 29.7.0

Timeline

2026-10-23: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.