CVE-2026-86189 in AVideo
Summary
by MITRE • 09/05/2026
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in WWBN AVideo represents a critical security flaw rooted in improper input validation and weak cryptographic implementation within the platform's video processing notification mechanism. Specifically, the defect resides in the notify.ffmpeg.json.php script, which is designed to handle asynchronous notifications regarding ffmpeg transcoding tasks. The core technical issue involves two distinct but compounding failures: path traversal due to unsanitized user-supplied data and authentication bypass via cryptographic token replay attacks. These flaws collectively allow an unauthenticated attacker to achieve arbitrary file write capabilities on the underlying server operating system, potentially leading to full remote code execution or complete compromise of the web application environment.
The first component of this vulnerability is a classic path traversal flaw associated with the avideoRelativePath parameter. When processing requests, the application accepts user-controlled input for this parameter without adequately sanitizing directory separators or resolving relative paths against a secure base directory. By supplying crafted values containing sequences such as dot-dot-slash (../), an attacker can manipulate the file system navigation logic to escape the intended upload or temporary directories. This lack of strict validation allows the write operation to target arbitrary locations on the disk, including sensitive configuration files, web root directories, or executable script paths that are directly accessible via HTTP requests.
Compounding this path traversal issue is a severe authentication bypass mechanism related to the notifyCode token. The application utilizes a cryptographic token for authenticating notification callbacks from external services or internal processes. However, the implementation fails to validate these tokens against expected values or maintain state regarding their usage. Instead of verifying that the token corresponds to an active, authorized session or task, the system merely decrypts the provided ciphertext and proceeds with the operation if decryption succeeds without error. This design oversight means that any previously issued valid ciphertext can be captured by a network observer or extracted from logs and subsequently replayed in future requests. Since the server does not check for token uniqueness, expiration, or binding to specific context data, it accepts these stale tokens as legitimate credentials, effectively rendering authentication meaningless for this endpoint.
The operational impact of combining path traversal with unauthenticated file writes is severe. An attacker can exploit this vulnerability to upload malicious PHP scripts into directories that are executable by the web server. Once a shell script or backdoor is written to an accessible location, such as the application root or a public assets folder, the attacker gains persistent remote code execution capabilities. This allows for comprehensive control over the compromised host, including data exfiltration, lateral movement within the network, installation of additional malware, and defacement of the web presence. Given that AVideo is often deployed in environments handling sensitive media content, such as educational institutions or corporate training platforms, this vulnerability poses a significant risk to confidentiality, integrity, and availability.
From an industry standards perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) and CWE-347: Improper Verification of Cryptographic Signature. The authentication bypass aspect also reflects weaknesses described in CWE-287: Improper Authentication, specifically regarding the failure to verify token validity beyond decryption success. In terms of attack patterns, this scenario maps closely to MITRE ATT&CK techniques T1059 (Command and Scripting Interpreter) for executing arbitrary code via uploaded scripts, and potentially T1190 (Exploit Public-Facing Application) as it targets a web-facing service without prior authentication.
Mitigation strategies must address both the input validation flaws and the cryptographic implementation errors immediately. Developers should implement strict allow-list validation for file paths, ensuring that all user-supplied directory inputs are resolved to absolute paths and checked against an expected base directory before any write operations occur. Additionally, symbolic link resolution should be enforced to prevent symlink attacks often associated with path traversal. Regarding authentication, the notifyCode token mechanism requires a complete redesign to include integrity checks such as HMAC signatures rather than simple encryption, ensuring that tokens cannot be tampered with or replayed. Implementing nonce values, expiration timestamps, and one-time-use counters for these tokens will effectively neutralize replay attacks. Furthermore, applying principle of least privilege by running the web application process under a restricted user account can limit the damage if an attacker successfully writes files to unexpected locations. Regular security audits focusing on file handling logic and cryptographic implementations are essential to prevent similar vulnerabilities in future updates.