CVE-2026-72748: AVideo Arbitrary File Write DOS Vulnerability

CVE-2026-72748 Overview

CVE-2026-72748 is an unauthenticated arbitrary file write vulnerability in AVideo, an open-source video streaming platform maintained by WWBN. The flaw resides in the aVideoEncoderChunk.json.php endpoint, which accepts HTTP PUT requests without verifying the caller's identity. Remote attackers can write up to 4 GB of arbitrary content to the server filesystem, exhausting disk space, poisoning the video encoding pipeline, or chaining the write with local file inclusion (LFI) to reach remote code execution (RCE). The weakness is classified under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated attackers can write attacker-controlled files to the AVideo server filesystem, enabling denial of service, encoding pipeline tampering, and potential remote code execution when combined with LFI.

Affected Products

AVideo (WWBN) — versions prior to the commit 1b55a9b3c4911d2f31594ce2e60566c70c6b95e8
Deployments exposing aVideoEncoderChunk.json.php to untrusted networks
AVideo encoder integrations that upload chunked media back to the platform

Discovery Timeline

2026-08-11 - CVE-2026-72748 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72748

Vulnerability Analysis

AVideo exposes aVideoEncoderChunk.json.php to receive encoded video chunks from the aVideoEncoder component. The endpoint accepts HTTP PUT uploads and writes the request body to disk. Prior to the fix, the endpoint performed no authentication or capability check on incoming requests. Any network-reachable client could submit a PUT request and cause the server to persist arbitrary bytes at a controlled location within the AVideo upload tree.

The writable size limit is roughly 4 GB per request, giving an attacker substantial control over both file size and content. Because AVideo dynamically includes PHP under its document root for encoder workflows, an attacker who can also influence path resolution can escalate this primitive into code execution.

Root Cause

The root cause is missing authentication on a state-changing endpoint (CWE-306). The chunk upload handler trusted that only the legitimate encoder service would call it, but nothing on the server enforced that assumption. There was no shared secret, session check, or signed token binding the request to a legitimate encoding job.

Attack Vector

An attacker sends an unauthenticated HTTP PUT request to aVideoEncoderChunk.json.php with an attacker-selected filename parameter and an arbitrary body up to 4 GB. The server writes the body to the encoder chunk directory. Repeated large uploads exhaust disk capacity, causing denial of service. Malformed chunks corrupt in-progress encoding jobs. If an LFI primitive exists elsewhere in the application, the attacker can stage a PHP payload through this endpoint and include it to achieve remote code execution.

php

                'filename' => $this->getFilename(),
                'videos_id' => $this->getId(),
                'notifyURL' => $global['webSiteRootURL'],
+                // Time-limited, site-salted token that authorises the encoder to write
+                // chunks back to aVideoEncoderChunk.json.php. Validated there with
+                // verifyToken(..., 'EncoderChunkUpload') — no DB lookup required.
+                'encoderChunkToken' => getToken(!empty($global['encoderChunkTokenTTL']) ? (int) $global['encoderChunkTokenTTL'] : 604800, 'EncoderChunkUpload'),
            ];

            if (empty($format)) {

Source: WWBN/AVideo commit 1b55a9b. The patch introduces a time-limited, site-salted encoderChunkToken generated with getToken() and validated at the chunk upload endpoint via verifyToken(..., 'EncoderChunkUpload'), closing the missing authentication gap.

Detection Methods for CVE-2026-72748

Indicators of Compromise

Unexpected HTTP PUT requests to /aVideoEncoderChunk.json.php from clients other than the authorized encoder host
Newly created files with unusual extensions (.php, .phtml, .htaccess) in AVideo upload or encoder chunk directories
Rapid disk space consumption on the AVideo server without a corresponding increase in legitimate encoding jobs
Web server access logs showing large request bodies (multi-hundred MB to GB) to the chunk endpoint

Detection Strategies

Inspect web server and PHP-FPM logs for PUT verbs directed at aVideoEncoderChunk.json.php and correlate the source IP against the known encoder infrastructure
Alert on file creation events within the AVideo videos/ and encoder chunk directories where the file extension is executable by the web server
Baseline the daily volume of chunk uploads and alert on sudden spikes in count or aggregate size

Monitoring Recommendations

Forward web server, PHP application, and filesystem audit logs to a centralized analytics pipeline for correlation across request, write, and process activity
Monitor AVideo host disk utilization with thresholds that page on rapid consumption, which is the earliest signal of an exploitation attempt
Track outbound child processes spawned by the PHP worker to detect follow-on code execution attempts that chain from a written payload

How to Mitigate CVE-2026-72748

Immediate Actions Required

Update AVideo to a build that includes commit 1b55a9b3c4911d2f31594ce2e60566c70c6b95e8 or later, which enforces the encoderChunkToken on chunk uploads
Restrict network access to aVideoEncoderChunk.json.php so that only the authorized encoder host can reach it, using firewall or reverse proxy allowlists
Audit AVideo upload and encoder chunk directories for unexpected files, particularly executable content, and quarantine anything unaccounted for

Patch Information

The fix is published in the WWBN/AVideo GitHub repository and documented in the GitHub Security Advisory GHSA-v7p7-jccx-h37c. Additional analysis is available in the VulnCheck advisory. The patch adds a site-salted, time-limited token (EncoderChunkUpload) issued to the encoder and verified at the chunk endpoint, with a default TTL of 604800 seconds configurable via $global['encoderChunkTokenTTL'].

Workarounds

Block or return 403 for HTTP PUT requests to aVideoEncoderChunk.json.php at the reverse proxy or web application firewall when patching cannot occur immediately
Deny PHP execution within upload and encoder chunk directories using web server configuration to break the LFI-to-RCE chain
Enforce source-IP allowlisting for the encoder endpoint so only trusted encoder hosts can submit chunks

bash

# nginx: block unauthenticated PUT to the vulnerable endpoint and
# deny PHP execution inside the upload/chunk tree
location = /aVideoEncoderChunk.json.php {
    limit_except GET POST { deny all; }
    allow 10.0.0.10;   # encoder host
    deny  all;
}

location ~* ^/videos/.*\.(php|phtml|phar)$ {
    deny all;
}