CRITICAL 9.3 NVD
CVE-2026-86189
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by sup
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-cprx-fggj-7vpq
- https://www.vulncheck.com/advisories/wwbn-avideo-unauthenticated-path-traversal-via-notify
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-09-05 via NVD.
Risk Timeline
CVE Disclosed2026-09-05 · -1 days ago
Remediation Resources
vulnfeed aggregates 10223 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.