WWBN AVideo versions up to 29.0 contain a path traversal vulnerability (CWE-22) in the locale save endpoint (`locale/save.php`). The vulnerability arises because the `$_POST['flag']` parameter is directly concatenated into a file path without sanitization, and the `$_POST['code']` parameter is written to that path. An attacker with admin privileges or the ability to CSRF an admin (due to missing CSRF token and permissive cookie settings) can traverse directories and write arbitrary PHP files to any writable location, enabling remote code execution. A fix was introduced in commit 57f89ffbc27d37c9d9dd727212334846e78ac21a, but no official patch or advisory details are provided in the input.

Successful exploitation allows an attacker with admin privileges or the ability to CSRF an admin to write arbitrary PHP files outside the intended directory, resulting in remote code execution with the privileges of the web server user. This can lead to full compromise of the affected system. The CVSS score is 8.7 (high severity), reflecting the ease of exploitation and the impact on confidentiality and integrity.

A fix is available as indicated by the referenced commit that sanitizes the file path input to prevent path traversal. Users should upgrade to a version including this fix or apply the patch from commit 57f89ffbc27d37c9d9dd727212334846e78ac21a. Until patched, restrict admin access and implement CSRF protections to reduce risk. Patch status is not yet confirmed via an official vendor advisory; check the vendor's resources for updated remediation guidance.