CVE-2026-84478
WWBN AVideo Unauthenticated Arbitrary Log File Deletion
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
0th
WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem.
| CWE | CWE-73 |
| Vendor | wwbn |
| Product | avideo |
| Published | Sep 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for wwbn avideo
Be the first to know when new high vulnerabilities affecting wwbn avideo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
WWBN / AVideo
0 ≤ 29.0
References
Credits
🔍 rajivraj