CVE-2026-84478: WWBN AVideo Unauthenticated Arbitrary Log File Deletion

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-01 · updated 2026-09-08
Weakness: CWE-73

Description

WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem.

Affected products

WWBN AVideo: through 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-wh69-gqmj-rcqg
https://www.vulncheck.com/advisories/wwbn-avideo-unauthenticated-arbitrary-log-file-deletion
https://github.com/WWBN/AVideo/security/advisories/GHSA-wh69-gqmj-rcqg

Get alerted when CVE-2026-84478 or the next vulnerability affects your stack