CVE-2026-86189: WWBN AVideo Path Traversal Vulnerability

CVE-2026-86189 Overview

WWBN AVideo contains a path traversal vulnerability [CWE-73] in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations on the server. The flaw stems from the avideoRelativePath parameter accepting caller-controlled paths without validation. Attackers can replay any previously issued ciphertext as a notifyCode token, which the application decrypts but never validates, bypassing authentication entirely. Successful exploitation lets remote attackers write attacker-chosen files to the application root and its subdirectories, enabling web shell deployment and full compromise of the AVideo instance.

Critical Impact
Unauthenticated remote attackers can write arbitrary files to the AVideo web root, leading to remote code execution and full application takeover.

Affected Products

WWBN AVideo (open-source video streaming platform)
notify.ffmpeg.json.php endpoint in AVideo distributions
Deployments exposing the AVideo notify endpoint to untrusted networks

Discovery Timeline

2026-09-05 - CVE-2026-86189 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86189

Vulnerability Analysis

The vulnerability resides in the notify.ffmpeg.json.php script, an endpoint intended to receive callback notifications from FFmpeg encoding jobs. The endpoint accepts two attacker-influenced inputs: a notifyCode authentication token and an avideoRelativePath parameter that determines where output data is written.

The authentication layer decrypts the supplied notifyCode ciphertext but performs no freshness, nonce, or binding checks against the decrypted plaintext. Any previously observed ciphertext—including one captured from legitimate encoding traffic—can be replayed indefinitely to satisfy the auth check.

Once authentication is bypassed, the avideoRelativePath value is concatenated into a filesystem path used to write data. Because the parameter is not constrained to a safe base directory, attackers can traverse into the application root and drop PHP files that the web server will execute.

Root Cause

Two compounding defects produce the impact. First, the token validation logic treats successful decryption as proof of authenticity without validating the plaintext contents or enforcing single-use semantics. Second, the file-write routine follows the External Control of File Name or Path pattern described in [CWE-73], trusting user input to build a destination path without canonicalization or allow-list enforcement.

Attack Vector

An unauthenticated attacker sends a crafted HTTP POST request to notify.ffmpeg.json.php, supplying any previously observed notifyCode ciphertext and an avideoRelativePath that traverses to a web-executable directory. The server decrypts the token, accepts it, and writes attacker-controlled bytes to the specified path. The attacker then requests the newly written PHP file to obtain code execution in the context of the AVideo web server user. No user interaction, credentials, or session state are required. See the VulnCheck advisory and the GitHub Security Advisory for endpoint specifics.

Detection Methods for CVE-2026-86189

Indicators of Compromise

HTTP requests to notify.ffmpeg.json.php containing avideoRelativePath values with ../, absolute paths, or references to .php files.
Unexpected PHP, .htaccess, or configuration files appearing under the AVideo web root or its subdirectories.
Repeated POST requests using identical notifyCode token values, indicating ciphertext replay.
Web-server processes spawning shells, curl, wget, or python immediately after a request to the notify endpoint.

Detection Strategies

Deploy web application firewall (WAF) rules that block requests to notify.ffmpeg.json.php containing path-traversal sequences or filenames ending in executable extensions.
Correlate file-creation events under the web root against the parent process; PHP-FPM writing new .php files is high signal.
Alert on repeated identical notifyCode values across distinct source IPs or across long time windows.

Monitoring Recommendations

Enable verbose web-server access logging for the /plugin/ and notify endpoints and forward logs to a centralized analytics platform.
Monitor filesystem integrity for the AVideo installation directory using host-based tooling.
Track outbound network connections from the web-server user to detect post-exploitation beaconing.

How to Mitigate CVE-2026-86189

Immediate Actions Required

Upgrade WWBN AVideo to the patched release referenced in the GitHub Security Advisory GHSA-cprx-fggj-7vpq.
Restrict network access to notify.ffmpeg.json.php so that only trusted encoder hosts can reach it.
Audit the AVideo web root and subdirectories for unexpected files created after the endpoint was exposed.
Rotate any secrets, API keys, and encryption material that resided on the affected host, since replayable ciphertexts may have leaked.

Patch Information

WWBN has issued a fix tracked in the project's GitHub Security Advisory GHSA-cprx-fggj-7vpq. Administrators should apply the vendor's updated release, which validates the decrypted notifyCode payload and constrains avideoRelativePath to an allow-listed directory. Additional technical context is available in the VulnCheck advisory.

Workarounds

Block external access to notify.ffmpeg.json.php at the reverse proxy or WAF until the patch is applied.
Add a WAF rule that rejects requests where avideoRelativePath contains .., /, \, or ends in .php, .phtml, or .htaccess.
Run the AVideo web-server process under a least-privileged account that cannot write to the web root.
Enforce filesystem-level immutability on the AVideo application directory where operationally feasible.

bash

# Example nginx configuration to block external access to the vulnerable endpoint
location = /plugin/Live/standAloneFiles/notify.ffmpeg.json.php {
    allow 10.0.0.0/8;      # trusted encoder subnet
    deny  all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}