CVE-2026-84478 in AVideo
Summary
by MITRE • 09/02/2026
WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified within WWBN AVideo represents a critical path traversal flaw located specifically in the get_api_login_code endpoint of its application programming interface. This security defect stems from insufficient validation or sanitization of user-supplied input, particularly the code parameter which is intended to hold authentication-related data but instead accepts arbitrary file system paths containing directory traversal sequences such as dot-dot-slash characters. By manipulating this parameter, an unauthenticated attacker can bypass expected access controls and direct the application to interact with files outside of its designated operational directories. This lack of input validation allows the underlying server-side logic to resolve these maliciously crafted paths, leading to unintended file system operations that compromise the integrity and availability of critical infrastructure components.
The primary technical impact of this vulnerability is the ability for attackers to delete arbitrary .log files from the target server's file system. While the immediate action appears to be destructive deletion, the broader implications involve significant information disclosure and operational disruption. By successfully deleting log files, an attacker can effectively erase audit trails that record user activities, authentication attempts, and administrative actions. This destruction of logs hinders incident response capabilities by removing evidence necessary for forensic analysis and compliance auditing. Furthermore, the ability to probe for file existence allows attackers to map out the server's directory structure, identifying sensitive configuration files or other resources that may be targeted in subsequent stages of an attack chain.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The exploitation technique leverages the application's failure to properly neutralize special elements within file paths that could cause unintended directory navigation. In terms of offensive security frameworks, this behavior corresponds to ATT&CK techniques related to Resource Hijacking and Defense Evasion, specifically the deletion or modification of logs to obscure malicious activity. The unauthenticated nature of the exploit means that no prior access credentials are required, significantly lowering the barrier for entry and increasing the likelihood of automated exploitation by threat actors scanning for vulnerable instances on public networks.
The operational impact extends beyond mere file loss; it undermines the trustworthiness of the system's security posture. When audit logs are compromised or destroyed, organizations lose visibility into potential breaches, making it difficult to detect ongoing attacks or assess the scope of data exposure. Additionally, the ability to probe for specific files can aid attackers in fingerprinting the server environment, identifying installed software versions, and locating other vulnerabilities such as configuration files containing hardcoded credentials or database connection strings. This reconnaissance phase is often a precursor to more severe exploits, including remote code execution or privilege escalation, thereby amplifying the overall risk associated with this single point of failure.
Mitigation strategies must focus on immediate remediation through patching and long-term architectural improvements. Administrators should apply the latest security updates provided by WWBN AVideo as soon as they become available to address the input validation deficiency in the get_api_login_code endpoint. In the interim, if a patch is not immediately deployable, network-level controls such as web application firewalls can be configured to detect and block requests containing directory traversal sequences within API parameters. Furthermore, implementing strict file system permissions where the web server process runs with minimal privileges can limit the impact of successful exploitation by restricting access to critical log directories. Regular audits of input validation logic across all API endpoints are essential to prevent similar vulnerabilities from being introduced in future development cycles.