Executive brief
WWBN AVideo is a video streaming and hosting platform. The application contains a vulnerability in its encoder notification API that allows attackers to write arbitrary files to the server without authentication. By replaying previously-captured authentication tokens and specifying custom file paths, an attacker can overwrite or inject files into the application, potentially leading to server compromise or service disruption.
Technical details
The vulnerability is a path traversal and broken authentication flaw in plugin/API/notify.ffmpeg.json.php. The endpoint accepts a notifyCode token that is decrypted but never validated for freshness or authenticity—any previously-issued ciphertext from the application (including video_id_hash values) will pass the check. Additionally, the avideoRelativePath parameter is concatenated directly to the application root without any containment or sanitization, allowing attackers to write files anywhere within the web root. The vulnerability requires standAloneFFMPEG to be configured (a documented deployment mode for separate encoder hosts), and the attacker controls both the destination path and source content. The attack is fully unauthenticated and requires only network access to the notify.ffmpeg.json.php endpoint.
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-08-21: disclosed: GitHub Security Advisory GHSA-cprx-fggj-7vpq published
- 2026-09-05: advisory: CVE-2026-86189 published on NVD