CRITICALVulnerability
CVE-2026-86189
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
Properties
- severity
- CRITICAL
- score
- 9.8
- cve_id
- CVE-2026-86189
- signal_observed_at
- 2026-09-18T21:50:21+00:00
- vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- published_at
- 2026-09-05T13:18:14.000
- last_modified
- 2026-09-18T18:17:18.263
Related Entities (2)
DESCRIBED_BY (1)
→[Source]NVD
HAS_WEAKNESS (1)
→[Weakness]External Control of File Name or Path
Explore deeper with Ninja Signal's threat intelligence graph