CVE-2026-86189
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Sep 05, 2026
Vendor
unknown
Description
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.