CVE-2026-86189Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-73

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

4 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-09-05); latest day: 1
4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-05	2	Disclosure1General1
2026-09-06	1	Disclosure1
2026-09-07	1	Disclosure1

Full discourse4 posts

Rıdvan Yağlı@ridvanyagli45d
Disclosure
🔴 CVE-2026-86189 — WWBN AVideo Güvenlik Açığı! AVideo 29.0 ve öncesi sürümleri etkileyen CVSS : 9.8 skorlu kritik bir Unauthenticated Arbitrary File Write / Path Traversal açığı duyuruldu. Bu açıkta; notify.ffmpeg.json.php endpoint'indeki avideoRelativePath parametresi üzerinden saldırgan, uygulamanın root dizinine ve alt dizinlerine kontrol ettiği dosyaları yazabiliyor. Üstelik notifyCode doğrulamasındaki zayıflık nedeniyle kimlik doğrulama mekanizması aşılabiliyor. • Authentication: Gerekmiyor • User Interaction: Gerekmiyor • Attack Vector: Network • CVSS v3.1: 9.8 Critical • Etkilenen sürümler: AVideo ≤ 29.0 Arbitrary file write, uygun koşullarda web shell/RCE ve dolayısıyla sunucunun tamamen ele geçirilmesine kadar ilerleyebilir. https://github.com/WWBN/AVideo/releases/tag/29.0
Post summary
A critical unauthenticated arbitrary file write / path traversal flaw is disclosed for AVideo versions 29.0 and earlier, enabling attackers to write files to the root hierarchy after bypassing authentication. No PoC, exploit code, or patch is supplied.
040631.2K
2.4K followersView on X
ThreatAft@ThreatAft46d
Disclosure
🔐🚨 WWBN AVideo — TWO UNAUTHENTICATED CVEs CVE-2026-86189 (9.8): Path traversal → arbitrary file write → RCE CVE-2026-86190 (9.1): Full user records exposed (password hashes, tokens) → https://threataft.com/articles/wwbn-avideo-two-unauthenticated-cves #cybersecurity #infosec #WWBN #AVideo #RCE #CVSS9 #ThreatIntel
Post summary
The tweet announces newly disclosed CVEs with detailed vulnerability descriptions and CVSS scores, but provides no PoC, exploit code, active exploitation claim, patch info, or debunking.
0000056
42 followersView on X
Severity Daily@severitydaily46d
Disclosure
AVideo's statistics endpoint returns every viewer's password hash, and the project's own advisory says the hash logs you in. No exploitation reported, and no patched release exists. https://severitydaily.com/avideo-cve-2026-86189-86190-viewer-password-hash-session-id-no-fix/
Post summary
The post reports a disclosure that AVideo’s statistics endpoint leaks all viewer password hashes, allowing authentication via hash without any known exploitation or patch.
0000045
23 followersView on X
CVE@CVEnew46d
General
CVE-2026-86189 WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying… https://www.cve.org/CVERecord?id=CVE-2026-86189
Post summary
The post describes a path traversal vulnerability in WWBN AVideo’s notify.ffmpeg.json.php enabling unauthenticated file writes, but provides no evidence of exploitation, patch status, or PoC.
00000778
58.1K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-86189

Rıdvan Yağlı[verified]@ridvanyagliDisclosure

A critical unauthenticated arbitrary file write / path traversal flaw is disclosed for AVideo versions 29.0 and earlier, enabling attackers to write files to the root hierarchy after bypassing authentication. No PoC, exploit code, or patch is supplied.

Severity Daily[verified]@severitydailyDisclosure

The post reports a disclosure that AVideo’s statistics endpoint leaks all viewer password hashes, allowing authentication via hash without any known exploitation or patch.

ThreatAft@ThreatAftDisclosure

The tweet announces newly disclosed CVEs with detailed vulnerability descriptions and CVSS scores, but provides no PoC, exploit code, active exploitation claim, patch info, or debunking.

CVE@CVEnewGeneral

The post describes a path traversal vulnerability in WWBN AVideo’s notify.ffmpeg.json.php enabling unauthenticated file writes, but provides no evidence of exploitation, patch status, or PoC.