CVE-2026-86189

Name of the Vulnerable Software and Affected Versions AVideo (affected versions not specified)

Description A path traversal issue exists in the 'notify.ffmpeg.json.php' endpoint. Unauthenticated attackers can write files to arbitrary locations within the application root and subdirectories by providing a custom path via the avideoRelativePath parameter. This is possible because the system allows the replay of previously issued ciphertext as a notifyCode token, which is decrypted but not validated, effectively bypassing authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.