An authenticated remote code execution vulnerability in WWBN AVideo versions up to 26.0 poses a critical risk to server integrity and data confidentiality.

The application fails to validate the extension of uploaded files against an allowlist, relying only on MIME type detection. An authenticated attacker can bypass this by uploading a polyglot file containing PHP code saved with a .php extension, leading to remote code execution.

Successful exploitation grants an attacker the ability to execute arbitrary commands on the underlying server, leading to a total loss of system control. This vulnerability carries a CVSS score of 8.8, reflecting the high potential for data exfiltration, unauthorized system modification, and complete service disruption.

Immediate Action: As no official patch release is currently identified, administrators should restrict access to the file upload functionality or disable the vulnerable ImageGallery component until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for requests targeting image directories that result in the execution of .php files or unusual script activity.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block file uploads that contain executable extensions or suspicious script signatures within image-related directories.

Public Exploit Available: Unknown.

Organizations utilizing WWBN AVideo should prioritize this vulnerability due to the critical nature of remote code execution. Monitor official vendor channels for the release of a security patch and apply it immediately upon availability to remediate the underlying logic flaw in file handling.