Path Traversal in WWBN AVideo via AI Plugin

Executive Summary

CVE-2026-124424 is a path traversal vulnerability in WWBN AVideo affecting versions up to 29.7.0. The flaw is in plugin/AI/receiveAsync.json.php where the unsanitized 'lang' parameter allows attackers with a valid AI token to write arbitrary .vtt files. By crafting a malicious 'lang' value in a type=translation request, an attacker can inject content into the webroot or overwrite other users' subtitle files.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious .vtt files in the webroot or /tmp directory. Look for files with unusual names or recent modification timestamps. Inspect network traffic for requests to plugin/AI/receiveAsync.json.php with type=translation and crafted lang parameters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to plant malicious files in the webroot or overwrite existing subtitle files. This could lead to defacement of websites, distribution of malicious content, or disruption of services. Attackers can also cause denial of service by overwriting critical files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized file writes in the webroot or subtitle files. Attackers may overwrite user data or plant malicious files, violating integrity and confidentiality requirements. GDPR's data integrity principles and HIPAA's safeguards for protected health information could be compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the AI plugin if not needed. Update to the latest version of AVideo if a patch is available. Restrict write permissions to the webroot and /tmp directories. Monitor for unauthorized .vtt file creation or modification.

Useful 0 Not Useful 0