Description

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-05T13:18:14.000Z",
  "pubdate": "2026-09-05T13:18:14.000Z",
  "executiveSummary": "The WWBN AVideo platform contains a critical path traversal vulnerability within the notify.ffmpeg.json.php component, enabling unauthenticated remote attackers to perform arbitrary file write operations.\nThe vulnerability stems from improper validation of user-supplied input combined with a flawed authentication mechanism involving predictable ciphertext replay.\nBy manipulating the avideoRelativePath parameter, an attacker can influence the destination of written files, potentially overwriting critical application configuration or executing arbitrary code by placing files within executable directories.\nThis vulnerability allows an unauthenticated actor to bypass security controls by replaying previously issued tokens, which the application decrypts but fails to validate against session or temporal constraints.\nThe impact includes full system compromise, remote code execution (RCE), and complete loss of integrity and confidentiality.\nThe risk is considered critical, as the exploit requires no prior authentication and can be executed over the network.",
  "technicalDetails": "The vulnerability resides in the notify.ffmpeg.json.php file, which processes requests intended for FFmpeg-related notifications. The primary architectural flaw involves an insecure implementation of file handling logic that trusts the avideoRelativePath parameter without sufficient sanitization or path normalization.\nSpecifically, the application logic fails to restrict the directory scope of file operations, allowing an attacker to utilize path traversal sequences (e.g., ../) to escape the intended directory and write files to arbitrary locations within the server's file system, including the application root and subdirectories.\nThe authentication mechanism is similarly flawed; the application utilizes a notifyCode token for verification. The vulnerability arises because the server decrypts the ciphertext provided in the notifyCode parameter but performs no subsequent validation of the token's validity, origin, or expiration. Consequently, an attacker can replay any previously intercepted or captured ciphertext to masquerade as an authorized process or user.\nThe exploitation flow proceeds as follows: First, the attacker identifies a valid, previously generated ciphertext token. Second, the attacker crafts an HTTP request to notify.ffmpeg.json.php, inserting the captured ciphertext into the notifyCode parameter to successfully bypass the authentication barrier. Third, the attacker provides a malicious path in the avideoRelativePath parameter, directing the application to write data to a sensitive location. Because the server processes this input with high privileges, the arbitrary write operation is performed, enabling the attacker to overwrite application configuration files, inject malicious PHP scripts, or perform other destructive actions.\nThis interaction demonstrates a failure in secure input validation and cryptographic design. The application treats the presence of a successfully decrypted token as sufficient proof of authorization, ignoring the inherent risks of replay attacks. By combining this authentication bypass with the unrestricted file path parameter, the application effectively provides an unauthenticated vector for full filesystem manipulation."
}