Path Traversal in WWBN AVideo via notify.ffmpeg.json.php

Executive Summary

CVE-2026-86189 is a path traversal vulnerability in WWBN AVideo's notify.ffmpeg.json.php file. It allows unauthenticated attackers to write files to arbitrary locations by exploiting a flawed token-based authentication mechanism and improper path validation. The avideoRelativePath parameter accepts user input without containment checks, enabling path traversal. The notifyCode token, decrypted but never validated, can be replayed to bypass authentication.

The attack requires the standAloneFFMPEG configuration to be enabled, which is not default. Successful exploitation could lead to arbitrary file writes, potentially enabling code execution if executable files are placed in web-accessible directories.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the notify.ffmpeg.json.php file exists in your AVideo installation and if the standAloneFFMPEG configuration is enabled. Inspect server logs for suspicious file write operations or requests containing the avideoRelativePath parameter with path traversal sequences like ../.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to write arbitrary files to any location within the application root. This could lead to unauthorized code execution if executable files are placed in web-accessible directories. Attackers could also overwrite sensitive files, modify application behavior, or plant malicious scripts to steal data or escalate privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access and modification of sensitive data. GDPR requires protection of personal data integrity and confidentiality, which could be violated through arbitrary file writes. HIPAA mandates strict controls over protected health information, which could be compromised if attackers write malicious files to sensitive directories.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable the standAloneFFMPEG configuration if enabled. Apply patches from the vendor to fix token validation and path containment. Monitor for unauthorized file writes and restrict write permissions to web root directories. Consider blocking external access to notify.ffmpeg.json.php if not required.

Useful 0 Not Useful 0