CVE-2026-72748 is a vulnerability in WWBN's AVideo product, specifically version 29.0, where the aVideoEncoderChunk.json.php endpoint does not require authentication for HTTP PUT requests. This allows unauthenticated remote attackers to write arbitrary files up to 4 GB in size to the server filesystem. The vulnerability can be exploited to exhaust disk space causing denial of service, interfere with video encoding processes, or be combined with local file inclusion vulnerabilities to achieve remote code execution. The CVSS 4.0 base score is 6.9, indicating a medium severity with low attack vector (local), low attack complexity, no privileges or user interaction required, but high impact on confidentiality.

The vulnerability enables unauthenticated attackers to write large arbitrary files to the server, which can exhaust disk space and cause denial of service. Additionally, attackers can poison the video encoding pipeline, disrupting service functionality. If combined with other vulnerabilities such as local file inclusion, it may lead to remote code execution, significantly increasing the risk to the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Until a patch is available, restrict access to the vulnerable endpoint and monitor for suspicious HTTP PUT requests if possible.