WWBN AVideo Unauthenticated Path Traversal Arbitrary File Write (notify.ffmpeg.json.php)

Technical Analysis

CVE-2026-86189 (CVSS 9.8) stems from insufficient input sanitization of the avideoRelativePath parameter in notify.ffmpeg.json.php, enabling directory traversal sequences to escape intended upload directories. The authentication bypass is compounded by a cryptographic validation flaw: the notifyCode token is decrypted server-side but its contents are never verified for freshness or binding, allowing any previously captured valid ciphertext to be replayed indefinitely. Chaining these flaws lets an unauthenticated attacker write attacker-controlled files (e.g., PHP webshells) to the web root, typically resulting in remote code execution. Organizations that self-host AVideo instances for internal video processing pipelines feeding into RAG systems, transcript ingestion for LLM training, or agent-driven media workflows should treat compromise of the host as a potential pivot point to exfiltrate API keys, vector store credentials, or other secrets accessible from that server.

Affected Systems

WWBN AVideo web application (versions prior to the patched release addressing notify.ffmpeg.json.php path traversal and notifyCode validation); self-hosted and containerized AVideo deployments exposed to the internet or internal networks without additional WAF protections

Indicators of Compromise

• notify.ffmpeg.json.php
• avideoRelativePath parameter with traversal sequences (e.g., ../../)
• Unexpected .php files written outside expected upload directories
• Repeated/replayed notifyCode token values in access logs
• Unusual outbound requests following file write to application root

Remediation Steps

1. 1

   Patch AVideo immediately

   Upgrade to the vendor-released fixed version that sanitizes avideoRelativePath and enforces single-use/expiring validation on notifyCode tokens.

2. 2

   Restrict network exposure

   Place AVideo instances behind a WAF or reverse proxy that blocks path traversal patterns and restrict access to trusted IP ranges where possible.

3. 3

   Audit for compromise

   Search the web root and subdirectories for unexpected files, especially PHP scripts, created or modified around the time of suspicious notify.ffmpeg.json.php requests.

4. 4

   Rotate credentials on affected hosts

   If AVideo is co-located with services holding API keys, database credentials, or agent/RAG pipeline secrets, rotate those credentials and review access logs for exfiltration.

5. 5

   Implement file integrity monitoring

   Deploy FIM on the AVideo web root to detect unauthorized file writes in real time.

6. 6

   Review notifyCode implementation

   If custom or forked AVideo deployments exist, ensure decrypted tokens are validated for expiration, nonce uniqueness, and intended use before being trusted.