An arbitrary file upload vulnerability in WWBN AVideo versions 26.0 and earlier allows authenticated attackers to achieve remote code execution.

This vulnerability is an unrestricted upload of a file with a dangerous type (CWE-434). Authenticated attackers can leverage the downloadVideoFromDownloadURL() function to bypass cleanup routines and leave malicious PHP files accessible within the web directory.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the underlying server, potentially leading to a full compromise of the application and its hosted data. Given the CVSS score of 8.8, this represents a high risk to organizational security, as it grants attackers the ability to manipulate video content, exfiltrate sensitive information, or pivot to other internal network segments.

Immediate Action: Review the provided security advisory from WWBN and verify if your current environment is patched via commit 6da79b43484099a0b660d1544a63c07b633ed3a2, as no official versioned fix is currently released. If the patch cannot be applied, restrict access to the videos/cache/ directory and limit access to the AVideo platform to trusted users only.

Proactive Monitoring: Monitor server logs for suspicious requests to the videos/cache/tmpFile/ directory and look for unexpected file creation events within the web root.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing malicious file extensions or suspicious parameter manipulation patterns targeting the aVideoEncoder.json.php endpoint.

Public Exploit Available: No (There is no confirmed public exploit or weaponized module available).

The severity of this vulnerability necessitates immediate attention, as it provides a direct path to server compromise. Administrators must prioritize the application of the upstream fix from the vendor repository or implement strict access controls to the affected endpoint until an official update is available.