CVE-2026-86189

WWBN AVideo, an open-source self-hosted video streaming platform, is affected by a path traversal flaw (CWE-73) in notify.ffmpeg.json.php that carries a critical CVSS 4.0 score of 9.3 and lets unauthenticated attackers write files to arbitrary filesystem locations. The endpoint accepts a caller-controlled avideoRelativePath parameter that determines where the file is written, and authentication is bypassed by replaying any previously issued ciphertext as the notifyCode token, which is decrypted but never validated. By replaying a captured notifyCode value and supplying an attacker-chosen relative path, an attacker can write files into the application root and its subdirectories, which on PHP deployments can enable remote code execution if web-executable files are planted. All WWBN AVideo deployments are potentially affected; the available data does not specify vulnerable version ranges or a fixed release. No exploitation is currently known: the issue is not in CISA KEV, EPSS is low at 0.4% (34th percentile), and no public proof-of-concept has been published.

What to do: Monitor the WWBN AVideo project for a patched release and upgrade as soon as one is published, since no fixed version is specified in the available data. As interim mitigation, restrict unauthenticated access to notify.ffmpeg.json.php at the web server or reverse proxy layer, and audit the AVideo application root and subdirectories for unexpected or recently written files (particularly .php files) that could indicate exploitation.