WWBN AVideo RCE: Path Traversal Exposes Servers to Arbitrary File Writes

A critical vulnerability, CVE-2026-40909, has been identified in WWBN AVideo, an open-source video platform. According to the National Vulnerability Database, versions 29.0 and prior are susceptible to Remote Code Execution (RCE) due to improper path sanitization. The locale/save.php endpoint directly concatenates user-supplied input ($_POST['flag']) into a file path without validation, allowing for directory traversal (CWE-22).

An attacker with administrative privileges can exploit this flaw. Crucially, the absence of CSRF tokens and the SameSite=None cookie policy mean that even non-admin users could potentially leverage Cross-Site Request Forgery (CSRF) to force an administrator’s browser to execute the attack. This allows the attacker to write arbitrary .php files to any writable location on the filesystem, leading to full RCE.

This isn’t just a theoretical bug; it’s a direct path to server compromise. The National Vulnerability Database assigns it a CVSS score of 8.7 (HIGH), underscoring the severity. The fix is available in commit 57f89ffbc27d37c9d9dd727212334846e78ac21a. Defenders must prioritize patching to prevent complete system takeover.