CVE-2026-72748

CRITICAL 9.1

AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.

CWE	CWE-306
Vendor	wwbn
Product	avideo
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for wwbn avideo

Be the first to know when new critical vulnerabilities affecting wwbn avideo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Affected Versions

WWBN / AVideo

29.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WWBN/AVideo/security/advisories/GHSA-v7p7-jccx-h37c github.com: https://github.com/WWBN/AVideo/commit/1b55a9b3c4911d2f31594ce2e60566c70c6b95e8 vulncheck.com: https://www.vulncheck.com/advisories/avideo-unauthenticated-arbitrary-file-write-via-avideoencoderchunk-json-php

Credits

🔍 DhiyaneshGeek 🔍 neo-ai-engineer