A critical authorization bypass in WWBN AVideo allows authenticated users to perform unauthorized file uploads, potentially leading to full system compromise.

The software contains an Insecure Direct Object Reference (IDOR) flaw where the upload functionality verifies authentication but fails to perform necessary ownership checks. This allows any authenticated user to upload files into directories belonging to other users.

The ability to upload arbitrary files into unauthorized directories presents a severe risk of data compromise and potential remote code execution. If an attacker uploads malicious scripts or overwrites existing configuration files, they could gain control over the streaming platform, leading to unauthorized access to sensitive video content or complete server takeover. With a CVSS score of 8.8, this vulnerability is classified as High and requires immediate remediation to prevent exploitation.

Immediate Action: Upgrade to AVideo version 20.1 or later immediately to apply the necessary ownership validation checks.

Proactive Monitoring: Monitor server upload directories for suspicious file types or unexpected changes in file permissions and ownership.

Compensating Controls: Implement strict file type filtering and directory-level restrictions at the web server level (e.g., Nginx or Apache) to prevent the execution of uploaded scripts in storage directories.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the referenced security research write-up.

The authorization flaw in AVideo poses a significant risk to the integrity and security of the hosting environment. Organizations currently running AVideo must prioritize the update to version 20.1 to address the missing ownership checks. Given the availability of public research regarding this and other vulnerabilities in the platform, failure to patch will leave the system vulnerable to unauthorized file management and potential escalation of privileges.