AVIDEO · CVE-2026-126809 · Runtime
NO FIX YET · SEE WHAT TO DO
AVideo through 29.7.1 has a missing authorization check in objects/import.json.php, so any uploader can import other users' MP4 files by pointing at any folder under videos/. An attacker can also list files, read sidecar descriptions, and delete victims' media.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted WWBN AVideo up to and including 29.7.1 (and master before commit 02471a4) where an admin has turned on the Import MP4 feature and users other than admins have upload permission. Any uploader can then copy other users' private, unlisted, password-protected or pay-per-view videos into their own channel, read their description sidecars, and delete the originals. Instances with Import MP4 left at its default (disabled) or with no untrusted uploaders can skip it for now.
Not affected if default-config, fixed-version, import-mp4-disabled, no-uploader-accounts
Who cares auth-required, self-hosted, video-hosting, wwbn-avideo
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims' .txt/.html sidecars as descriptions, list files via objects/listFiles.json.php, and delete victims' media using the delete parameter.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.