CVE-2026-72748

Name of the Vulnerable Software and Affected Versions AVideo (affected versions not specified)

Description An unauthenticated arbitrary file write issue exists in the 'aVideoEncoderChunk.json.php' endpoint. Remote attackers can use HTTP PUT requests to write up to 4 GB of arbitrary content to the server filesystem without authentication. This can lead to disk space exhaustion causing denial of service, poisoning of the video encoding pipeline, or remote code execution when combined with local file inclusion.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.