Critical severity9.8NVD Advisory· Published Sep 5, 2026· Updated Sep 18, 2026
CVE-2026-86189
CVE-2026-86189
Description
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
1- WWBN AVideo: 25 Vulnerabilities Disclosed in Early September 2026 BatchVypr Intelligence · Sep 5, 2026