Executive brief
AVideo is a popular video hosting and streaming platform. The aVideoEncoderChunk.json.php endpoint allows unauthenticated attackers to write up to 4 GB of arbitrary data per request to the server's filesystem via HTTP PUT requests. An attacker can exhaust disk space causing complete service outage, inject malicious content into the video encoding pipeline, or achieve remote code execution when combined with local file inclusion vulnerabilities.
Technical details
The vulnerability is an unauthenticated arbitrary file write in objects/aVideoEncoderChunk.json.php, a standalone PHP endpoint that lacks the authentication framework required by other AVideo endpoints. The endpoint accepts HTTP PUT requests with raw request body content and writes it directly to /tmp/YTPChunk_<file_id> or temp files without any authentication, API key, session, or token validation. The file_id parameter is validated only by a hex regex (/^[0-9a-f]{1,64}$/i) which prevents path traversal but not the core unauthenticated write. The endpoint also hardcodes Access-Control-Allow-Origin: * enabling cross-origin exploitation from JavaScript. An attacker can write up to 4 GB per request, exhaust disk space, poison the encoding pipeline, or chain with local file inclusion for RCE. A patch was committed on 2026-07-21 implementing token-based and credential-based authentication.
Affected products
- WWBN AVideo 29.0
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched: Commit 1b55a9b adds encoder chunk token generation and authentication
- 2026-08-11: advisory