CVE-2026-84478: External Control of File Name or Path in WWBN AVideo

CVE-2026-84478 describes a path traversal vulnerability in the WWBN AVideo product's get_api_login_code API endpoint. An attacker can supply directory traversal sequences in the 'code' parameter to delete arbitrary .log files on the server without authentication. This enables attackers to erase audit logs and probe for file existence, resulting in both file deletion and information disclosure about the filesystem. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No vendor advisory or patch information is available at this time.

The vulnerability allows unauthenticated attackers to delete arbitrary log files, potentially erasing audit trails and hindering forensic investigations. Additionally, attackers can gain information about the filesystem structure by probing file existence. This can facilitate further attacks or reconnaissance. The impact is limited to file deletion and information disclosure, with no indication of remote code execution or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint if possible and monitor for suspicious activity related to file deletions or abnormal API requests targeting the 'code' parameter.