{"id":"CVE-2026-124424","kind":"vulnerability","aliases":["CVE-2026-124424"],"related":[],"title":"WWBN AVideo: path traversal lets token holders write arbitrary subtitle files","description":"WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized response[lang] parameter. Attackers can send a type=translation request with a crafted lang value to plant attacker-controlled content in the webroot or overwrite other users' subtitle files.","summary":"AVideo's AI plugin endpoint plugin/AI/receiveAsync.json.php does not sanitize the lang parameter when saving translated subtitles. A holder of any valid AI token can write .vtt files anywhere the web server can write, including the webroot or over other users' subtitle files.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AVideo","fixed":[],"affected":"current master (checked 2026-10-09), no patched release","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-plugin","avideo","other","php","self-hosted"],"not_affected_if":["ai-plugin-disabled","no-ai-plugin","no-ai-tokens"],"how_to_check":"- Check whether plugin/AI/receiveAsync.json.php exists and the AI plugin is enabled (Plugins page in AVideo admin).\n- Advisory lists no patched release; all current master (clone dated 2026-10-09) is affected. Check for any .vtt files outside videos/<name>/ (e.g. find webroot -name '*.vtt' -not -path '*/videos/*').","fix":"No patched version per the vendor advisory (GHSA-v64v-r7qm-w5x4). Until one ships: validate lang against /^[a-z0-9_-]{2,8}$/i or reject '/', '\\', '..' and NUL in Ai_transcribe_responses::getVTTPaths(); disable the AI plugin.","status":"open","published_at":"2026-11-08T14:18:07+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","triaged_at":"2026-11-08T14:49:55+00:00","updated_at":"2026-11-08T14:51:08+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-08T14:49:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WWBN AVideo: path traversal lets token holders write arbitrary subtitle files","impact":"medium","summary":"AVideo's AI plugin endpoint plugin/AI/receiveAsync.json.php does not sanitize the lang parameter when saving translated subtitles. A holder of any valid AI token can write .vtt files anywhere the web server can write, including the webroot or over other users' subtitle files.","audience":"businesses","category":"other","nicknames":[],"who_cares":["avideo","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker plants or overwrites files on the web server","analyst_note":"Find the affected and fixed AVideo versions and the vendor advisory on github.com to confirm how_to_check and fix.","how_to_check":"- Check whether the AVideo installation includes the AI plugin at `plugin/AI/receiveAsync.json.php`\n- Confirm the AVideo version in the installation against the fixed version, if the sources give one\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-ai-plugin","no-ai-tokens"],"who_is_affected":"Sites running the WWBN AVideo platform with the AI plugin and AI tokens issued to users are exposed, since the flaw needs a valid AI token. Installations without the AI plugin or without issued AI tokens are not affected by this path. The sources do not state the affected version range.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000744,"input_tokens":4638,"output_tokens":561,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed AVideo versions and the vendor advisory on github.com to confirm how_to_check and fix.","search":"'-124424':14A,17A '-2026':13A,16A 'ai':20B,30B,49B,85C 'ai-plugin':19B 'allow':80C 'anywher':55B 'arbitrari':9A,89C 'attack':102C,117C 'attacker-control':116C 'avideo':2A,18A,22B,28B,71C 'contain':72C 'content':119C 'control':118C 'craft':111C 'cve':12A,15A 'endpoint':32B 'file':11A,54B,69B,91C,128C 'holder':7A,45B,81C 'host':27B 'includ':61B 'inject':93C 'lang':38B,100C,112C 'let':5A 'overwrit':124C 'paramet':39B,101C 'path':3A,74C 'php':24B 'plant':115C 'plugin':21B,31B 'plugin/ai/receiveasync.json.php':33B,78C 'request':108C 'respons':99C 'sanit':36B 'save':41B 'self':26B 'self-host':25B 'send':104C 'sequenc':95C 'server':58B 'subtitl':10A,43B,68B,127C 'token':6A,50B,86C 'translat':42B,107C 'travers':4A,75C,94C 'type':106C 'unsanit':98C 'user':67B,126C 'valid':48B,84C 'valu':113C 'vtt':53B,90C 'vulner':76C 'web':57B 'webroot':63B,122C 'write':8A,52B,60B,88C 'wwbn':1A,70C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted AVideo sites with the bundled AI plugin enabled are exposed. Anyone holding any valid AI token (tokens never expire and are not tied to a user or video) can write attacker-controlled .vtt files anywhere the web server user can write, including the webroot or over other users' subtitles. It is not direct code execution. Sites with the AI plugin disabled can skip it. The vendor gives no version range, only current master.","tier":"B","verified":{"fix":{"at":"2026-11-08T14:51:08Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/security/advisories/GHSA-v64v-r7qm-w5x4","run_id":2185},"how_to_check":{"at":"2026-11-08T14:51:08Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/security/advisories/GHSA-v64v-r7qm-w5x4","run_id":2185},"who_affected":{"at":"2026-11-08T14:51:08Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/security/advisories/GHSA-v64v-r7qm-w5x4","run_id":2185}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["avideo"],"ptokens":["avideo"],"labels":["aiplugin","avideo","high","other","php","selfhosted"],"campaign_type":null,"search_a":"'-124424':14A,17A '-2026':13A,16A 'arbitrari':9A 'avideo':2A,18A 'cve':12A,15A 'file':11A 'holder':7A 'let':5A 'path':3A 'subtitl':10A 'token':6A 'travers':4A 'write':8A 'wwbn':1A","search_b":"'ai':20B,30B,49B 'ai-plugin':19B 'anywher':55B 'avideo':22B,28B 'endpoint':32B 'file':54B,69B 'holder':45B 'host':27B 'includ':61B 'lang':38B 'paramet':39B 'php':24B 'plugin':21B,31B 'plugin/ai/receiveasync.json.php':33B 'sanit':36B 'save':41B 'self':26B 'self-host':25B 'server':58B 'subtitl':43B,68B 'token':50B 'translat':42B 'user':67B 'valid':48B 'vtt':53B 'web':57B 'webroot':63B 'write':52B,60B","search_c":"'ai':85C 'allow':80C 'arbitrari':89C 'attack':102C,117C 'attacker-control':116C 'avideo':71C 'contain':72C 'content':119C 'control':118C 'craft':111C 'file':91C,128C 'holder':81C 'inject':93C 'lang':100C,112C 'overwrit':124C 'paramet':101C 'path':74C 'plant':115C 'plugin/ai/receiveasync.json.php':78C 'request':108C 'respons':99C 'send':104C 'sequenc':95C 'subtitl':127C 'token':86C 'translat':107C 'travers':75C,94C 'type':106C 'unsanit':98C 'user':126C 'valid':84C 'valu':113C 'vtt':90C 'vulner':76C 'webroot':122C 'write':88C 'wwbn':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-23T23:02:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124424","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124424","severity":null,"published_at":"2026-11-08T14:18:07+00:00","modified_at":"2026-11-08T14:18:08+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","fetched_at":"2026-11-08T14:48:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124424:2185","url":null,"severity":null,"published_at":"2026-11-08T14:51:08+00:00","modified_at":"2026-11-08T14:51:08+00:00","first_seen_at":"2026-11-08T14:51:08+00:00","fetched_at":"2026-11-08T14:51:08+00:00","note":"Read GitHub advisory GHSA-v64v-r7qm-w5x4: no patched version, affects current master (clone 2026-10-09), needs AI plugin enabled and any valid AI token. No exploitation reported; PoC is in the advisory."}],"documents":[{"id":102032,"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-v64v-r7qm-w5x4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T23:02:08+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102033,"url":"https://www.vulncheck.com/advisories/wwbn-avideo-path-traversal-arbitrary-vtt-file-write-via-receiveasync-json-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}