CVE-2026-40909Disclosure(wwbn / avideo)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint (`locale/save.php`) constructs a file path by directly concatenating `$_POST['flag']` into the path at line 30 without any sanitization. The `$_POST['code']` parameter is then written verbatim to that path via `fwrite()` at line 40. An admin attacker (or any user who can CSRF an admin, since no CSRF token is checked and cookies use `SameSite=None`) can traverse out of the `locale/` directory and write arbitrary `.php` files to any writable location on the filesystem, achieving Remote Code Execution. Commit 57f89ffbc27d37c9d9dd727212334846e78ac21a fixes the issue.

wwbn CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/WWBN/AVideo/commit/57f89ffbc27d37c9d9dd727212334846e78ac21a

Exploit / PoC references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

avideo

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-04-21); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

wwbn

Products

avideo

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CVE@CVEnew163d
Disclosure
CVE-2026-40909 WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint (`locale/save.php`) constructs a file path by directly concatenatin… https://www.cve.org/CVERecord?id=CVE-2026-40909
Post summary
The post references CVE-2026-40909, noting that in AVideo 29.0 and earlier the locale save endpoint constructs a file path via direct concatenation, which represents a potential path manipulation vulnerability.
00010164
57.3K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds169d
Disclosure
CVE-2026-40909 Remote Code Execution via Path Traversal in WWBN AVideo 29.0 and Prior https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40909
Post summary
The post announces the discovery of CVE-2026-40909, describing it as a remote code execution flaw via path traversal in WWBN AVideo 29.0 and earlier versions. No exploit code, active attacks, or patch information are provided.
0000137
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	wwbn	avideo	-	-	-

Explore more

Back to dashboard wwbn CVEs avideo vulnerabilities