{"id":"CVE-2026-126804","kind":"vulnerability","aliases":["CVE-2026-126804"],"related":[],"title":"WWBN AVideo: path traversal in ADs plugin lets users delete arbitrary files","description":"WWBN AVideo 12.4 through 29.7.1 contains a path traversal vulnerability in the ADs plugin deleteImage.json.php that allows authenticated users with custom ads to delete arbitrary files. Attackers can set the unvalidated is_regular_user parameter to another user's id or ../ sequences to delete other users' ads or files like videos/configuration.php, taking the site offline and re-exposing the installer.","summary":"AVideo's ADs plugin deleteImage.json.php does not validate the is_regular_user parameter or path sequences, so a logged-in user with custom ads can delete other users' ads or arbitrary files. Deleting videos/configuration.php takes the site offline and re-exposes the installer.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avideo","other","php","self-hosted"],"not_affected_if":["default-config","no-ads-plugin"],"how_to_check":"- Check whether the AVideo install runs the ADs plugin and whether the affected range (12.4 through 29.7.1) applies to your version\n- Review the installed version in the AVideo admin panel or version file","fix":"- Move to an AVideo version above 29.7.1 (fixed version not stated in the sources)","status":"open","published_at":"2026-11-11T21:16:44+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","triaged_at":"2026-11-11T21:30:43+00:00","updated_at":"2026-11-11T21:30:43+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T21:30:43Z","model":"claude-haiku-5-5","output":{"fix":"- Move to an AVideo version above 29.7.1 (fixed version not stated in the sources)\n- unknown","reach":"internet","title":"WWBN AVideo: path traversal in ADs plugin lets users delete arbitrary files","impact":"high","summary":"AVideo's ADs plugin deleteImage.json.php does not validate the is_regular_user parameter or path sequences, so a logged-in user with custom ads can delete other users' ads or arbitrary files. Deleting videos/configuration.php takes the site offline and re-exposes the installer.","audience":"businesses","category":"other","nicknames":[],"who_cares":["avideo","self-hosted","php"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Arbitrary files deleted, site taken offline, installer re-exposed","analyst_note":"Find the fixed AVideo version and the vendor advisory text on github.com to confirm fix and how_to_check.","how_to_check":"- Check whether the AVideo install runs the ADs plugin and whether the affected range (12.4 through 29.7.1) applies to your version\n- Review the installed version in the AVideo admin panel or version file\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","no-ads-plugin"],"who_is_affected":"Sites running WWBN AVideo versions 12.4 through 29.7.1 with the ADs plugin enabled, where users can create custom ads. Sites on other versions or without the ADs plugin are not described as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4661,"output_tokens":575,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126804':15A,18A '-2026':14A,17A '12.4':72C '29.7.1':74C 'ad':6A,27B,49B,54B,82C,91C,116C 'allow':86C 'anoth':106C 'arbitrari':11A,56B,94C 'attack':96C 'authent':87C 'avideo':2A,19B,25B,71C 'contain':75C 'custom':48B,90C 'cve':13A,16A 'delet':10A,51B,58B,93C,113C 'deleteimage.json.php':29B,84C 'expos':67B,128C 'file':12A,57B,95C,118C 'host':24B 'id':109C 'instal':69B,130C 'let':8A 'like':119C 'log':44B 'logged-in':43B 'offlin':63B,124C 'paramet':37B,104C 'path':3A,39B,77C 'php':21B 'plugin':7A,28B,83C 're':66B,127C 're-expos':65B,126C 'regular':35B,102C 'self':23B 'self-host':22B 'sequenc':40B,111C 'set':98C 'site':62B,123C 'take':60B,121C 'travers':4A,78C 'unvalid':100C 'user':9A,36B,46B,53B,88C,103C,107C,115C 'valid':32B 'videos/configuration.php':59B,120C 'vulner':79C 'wwbn':1A,70C","nicknames":[],"mitigations":[],"who_affected":"Sites running WWBN AVideo versions 12.4 through 29.7.1 with the ADs plugin enabled, where users can create custom ads. Sites on other versions or without the ADs plugin are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["avideo","high","other","php","selfhosted"],"campaign_type":null,"search_a":"'-126804':15A,18A '-2026':14A,17A 'ad':6A 'arbitrari':11A 'avideo':2A 'cve':13A,16A 'delet':10A 'file':12A 'let':8A 'path':3A 'plugin':7A 'travers':4A 'user':9A 'wwbn':1A","search_b":"'ad':27B,49B,54B 'arbitrari':56B 'avideo':19B,25B 'custom':48B 'delet':51B,58B 'deleteimage.json.php':29B 'expos':67B 'file':57B 'host':24B 'instal':69B 'log':44B 'logged-in':43B 'offlin':63B 'paramet':37B 'path':39B 'php':21B 'plugin':28B 're':66B 're-expos':65B 'regular':35B 'self':23B 'self-host':22B 'sequenc':40B 'site':62B 'take':60B 'user':36B,46B,53B 'valid':32B 'videos/configuration.php':59B","search_c":"'12.4':72C '29.7.1':74C 'ad':82C,91C,116C 'allow':86C 'anoth':106C 'arbitrari':94C 'attack':96C 'authent':87C 'avideo':71C 'contain':75C 'custom':90C 'delet':93C,113C 'deleteimage.json.php':84C 'expos':128C 'file':95C,118C 'id':109C 'instal':130C 'like':119C 'offlin':124C 'paramet':104C 'path':77C 'plugin':83C 're':127C 're-expos':126C 'regular':102C 'sequenc':111C 'set':98C 'site':123C 'take':121C 'travers':78C 'unvalid':100C 'user':88C,103C,107C,115C 'videos/configuration.php':120C 'vulner':79C 'wwbn':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:02:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126804","severity":null,"published_at":"2026-11-11T21:16:44+00:00","modified_at":"2026-11-11T21:16:44+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","fetched_at":"2026-11-11T21:29:08+00:00","note":null}],"documents":[{"id":128970,"url":"https://github.com/WWBN/AVideo/commit/c2b99663d6442e2182a0f3ab95ea6731a193b301","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128971,"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-58h3-9722-fgpm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-11T14:02:41+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":128972,"url":"https://www.vulncheck.com/advisories/wwbn-avideo-12.4-through-29.7.1-path-traversal-file-deletion-via-deleteimage-json-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}