CVE-2026-72748

AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php

State: Published
Severity: 6.9 Medium
Published: Aug 11, 2026
Updated: Aug 11, 2026
Reserved: Aug 10, 2026

Description

AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	VulnCheck

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
AVideoWWBN	29.0Affected

References

GitHub Security Advisory (GHSA-v7p7-jccx-h37c)vendor-advisory
https://github.com/WWBN/AVideo/commit/1b55a9b3c4911d2f31594ce2e60566c70c6b95e8patch
VulnCheck Advisory: AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.phpthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.