What’s Vulnerable › Vulnerabilities

CVE-2026-86189: WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-05 · updated 2026-09-18
• Weakness: CWE-73

Description

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.

Affected products

• WWBN AVideo: through 29.0

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-cprx-fggj-7vpq
• https://www.vulncheck.com/advisories/wwbn-avideo-unauthenticated-path-traversal-via-notify-ffmpeg-json-php

Get alerted when CVE-2026-86189 or the next vulnerability affects your stack