CVE-2026-86189— WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
Quick assessment
Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WWBN AVideo 在 中存在路径遍历漏洞，该漏洞允许未经身份验证的攻击者通过在 参数中提供由调用方指定的路径，从而将文件写入任意位置。攻击者可以重放任何先前颁发的密文作为 令牌（该令牌会被解密但从未进行有效性校验），以此绕过身份验证，并将文件写入应用程序根目录及其子目录。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86189
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
Source: CVE Program / CVE List V5
Vulnerability Description
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-86189
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86189
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86189 (2)
-
🔗 Broken Access Control and Path Traversal: notify.ffmpeg.json.php writes a downloaded file to a caller-chosen path, behind a token that is decrypted but never inspected, so any ciphertext the site has issued authenticates the request · Advisory · WWBN/AVideo · GitHub Read full article vendor-advisory
-
Same Patch Batch · WWBN · 2026-09-05 · 5 CVEs total
| CVE-2026-86190 | 9.1 CRITICAL | WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter |
| CVE-2026-86188 | 7.2 HIGH | AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting |
| CVE-2026-86186 | 6.5 MEDIUM | AVideo API Rate Limit Bypass via Bot User-Agent Header |
| CVE-2026-86187 | 5.9 MEDIUM | WWBN AVideo Weak PRNG Password Generation via External Login |
IV. Related Vulnerabilities
Same product: AVideo
-
CVE-2026-86190
WWBN AVideo Broken Access Control via videoViewsInfo hash Pa -
CVE-2026-86188
AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting -
CVE-2026-86186
AVideo API Rate Limit Bypass via Bot User-Agent Header -
CVE-2026-86187
WWBN AVideo Weak PRNG Password Generation via External Login -
CVE-2026-85577
AVideo userLogin.php Reflected XSS via error parameter
Same vendor: WWBN
-
CVE-2026-86190
WWBN AVideo Broken Access Control via videoViewsInfo hash Pa -
CVE-2026-86188
AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting -
CVE-2026-86187
WWBN AVideo Weak PRNG Password Generation via External Login -
CVE-2026-86186
AVideo API Rate Limit Bypass via Bot User-Agent Header -
CVE-2026-85577
AVideo userLogin.php Reflected XSS via error parameter
Same weakness: CWE-73
-
CVE-2026-80119
PassMark PerformanceTest, BurnInTest, and OSForensics Physic -
CVE-2026-85687
surya 0.22.1 Unauthenticated Arbitrary File Read via screens -
CVE-2026-85684
marker through 2.0.0 Path Traversal via upload filename -
CVE-2026-85668
Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read vi -
CVE-2026-85603
Grav Admin Plugin Path Traversal via Save As Language Code
V. Comments for CVE-2026-86189
No comments yet