CVE-2026-86189 WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
Unauthenticated attackers can write arbitrary files to the server via path traversal in notify.ffmpeg.json.php, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86189?
CVE-2026-86189 is a critical path traversal vulnerability in WWBN AVideo, published on 5 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
Weakness: CWE-73
Which versions are affected by CVE-2026-86189?
How do I fix CVE-2026-86189?
No fix has been published for CVE-2026-86189 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-86189 being exploited?
There is no known exploitation of CVE-2026-86189 in the wild and no public exploit code.
Sources
Also known as GHSA-cprx-fggj-7vpq, GHSA-w6w9-fw29-2x88.