# CVE-2026-86189: WWBN AVideo path traversal in notify.ffmpeg.json.php

Source: https://junglewise.ai/threats/cve-2026-86189-wwbn-avideo-path-traversal-in-notify-ffmpeg-json-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86189 · Severity: critical · CVSS 9.8 · Published 2026-09-05

WWBN AVideo is a video streaming and hosting platform. The application contains a vulnerability in its encoder notification API that allows attackers to write arbitrary files to the server without authentication. By replaying previously-captured authentication tokens and specifying custom file paths, an attacker can overwrite or inject files into the application, potentially leading to server compromise or service disruption.

Technologies: [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-86189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86189 being exploited in the wild.

**How severe is CVE-2026-86189?** Critical severity, with a CVSS score of 9.8, published 5 September 2026.

**Which products and versions are affected?** WWBN AVideo 29.0 and earlier.

**Is there a fix for CVE-2026-86189?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86189 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86189?** Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal and broken authentication flaw in plugin/API/notify.ffmpeg.json.php. The endpoint accepts a notifyCode token that is decrypted but never validated for freshness or authenticity—any previously-issued ciphertext from the application (including video_id_hash values) will pass the check. Additionally, the avideoRelativePath parameter is concatenated directly to the application root without any containment or sanitization, allowing attackers to write files anywhere within the web root. The vulnerability requires standAloneFFMPEG to be configured (a documented deployment mode for separate encoder hosts), and the attacker controls both the destination path and source content. The attack is fully unauthenticated and requires only network access to the notify.ffmpeg.json.php endpoint.

## Affected products

- WWBN AVideo 29.0 and earlier

## Timeline

- 2026-08-21: disclosed: GitHub Security Advisory GHSA-cprx-fggj-7vpq published
- 2026-09-05: advisory: CVE-2026-86189 published on NVD

## References

- [https://github.com/WWBN/AVideo/security/advisories/GHSA-cprx-fggj-7vpq](https://github.com/WWBN/AVideo/security/advisories/GHSA-cprx-fggj-7vpq)
- [https://www.vulncheck.com/advisories/wwbn-avideo-unauthenticated-path-traversal-via-notify-ffmpeg-json-php](https://www.vulncheck.com/advisories/wwbn-avideo-unauthenticated-path-traversal-via-notify-ffmpeg-json-php)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)