CVE-2026-124424

HIGH 7.1

WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.php

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized response[lang] parameter. Attackers can send a type=translation request with a crafted lang value to plant attacker-controlled content in the webroot or overwrite other users' subtitle files.

CWE	CWE-22
Vendor	wwbn
Product	avideo
Published	Nov 8, 2026

Stay Ahead of the Next One

Get instant alerts for wwbn avideo

Be the first to know when new high vulnerabilities affecting wwbn avideo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Affected Versions

WWBN / AVideo

0 ≤ 29.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WWBN/AVideo/security/advisories/GHSA-v64v-r7qm-w5x4 vulncheck.com: https://www.vulncheck.com/advisories/wwbn-avideo-path-traversal-arbitrary-vtt-file-write-via-receiveasync-json-php