CVE-2026-86189 - WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
Brief
CVE ID : CVE-2026-86189
Published : Sept. 5, 2026, 1:18 p. m.
- 7 hours, 27 minutes ago
Description : WWBN AVideo contains a path traversal vulnerability in notify. ffmpeg. json. php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter.
Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
Severity: 9.8
- CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...