CVE-2026-86189 — WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-c…
Published: 2026-09-05 · CVSS: 9.3 · CVSS 4.0
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7