CVE-2026-86189: External Control of File Name or Path in WWBN AVideo

CVE-2026-86189 describes a path traversal vulnerability in the notify.ffmpeg.json.php component of WWBN AVideo. The flaw allows unauthenticated attackers to specify arbitrary file paths via the avideoRelativePath parameter, enabling them to write files anywhere within the application root or its subdirectories. The authentication bypass is possible because the notifyCode token, which is decrypted, is never validated, allowing replay of any previously issued ciphertext. This vulnerability is rated critical with a CVSS 4.0 score of 9.3.

An attacker can write files to arbitrary locations on the server running WWBN AVideo without authentication. This can lead to unauthorized file creation or modification, potentially enabling further compromise such as code execution or persistent backdoors. The authentication bypass increases the risk by allowing attackers to exploit the vulnerability without valid credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected notify.ffmpeg.json.php endpoint and monitor for suspicious activity related to file writes. Avoid exposing this endpoint publicly if possible.