Unauthenticated Arbitrary File Write in AVideo

Executive Summary

CVE-2026-72748 is an unauthenticated arbitrary file write vulnerability in AVideo affecting the aVideoEncoderChunk.json.php endpoint. It allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. The endpoint lacks proper access controls and is isolated from AVideo's authentication framework.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized HTTP PUT requests to the aVideoEncoderChunk.json.php endpoint. Monitor for large file writes in /tmp/YTPChunk_* or unexpected files in AVideo directories. Use network traffic analysis tools like tcpdump or Wireshark to inspect PUT requests targeting this endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial of service by exhausting disk space, poisoning the video encoding pipeline, or chaining with local file inclusion to achieve remote code execution. Attackers can write arbitrary files silently due to the endpoint's hardcoded cross-origin access.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the official patch from Resource 2 by updating to a fixed AVideo version. Block HTTP PUT requests to aVideoEncoderChunk.json.php at the firewall or web server level. Disable the endpoint if not needed. Monitor disk usage and file system changes for suspicious activity.

Useful 0 Not Useful 0