A critical unauthenticated path traversal vulnerability in WWBN AVideo allows remote attackers to perform arbitrary file writes, potentially leading to full system compromise.

The application suffers from a path traversal flaw in the notify.ffmpeg.json.php script, which fails to validate the avideoRelativePath parameter. Furthermore, the application fails to validate the notifyCode token, allowing unauthenticated attackers to bypass authentication controls and execute arbitrary file writes.

The ability for an unauthenticated attacker to write arbitrary files to the application root and subdirectories presents a severe risk of remote code execution. Given the CVSS score of 9.8, this vulnerability carries the highest level of urgency. Successful exploitation could result in total system takeover, data exfiltration, or the deployment of malicious payloads, causing significant operational disruption and reputational damage.

Immediate Action: Review the official GitHub security advisory for WWBN AVideo and apply any available patches or updates provided by the vendor. If a patch is not yet available, restrict access to the notify.ffmpeg.json.php endpoint at the network or web server level.

Proactive Monitoring: Monitor web access logs for unusual requests directed at notify.ffmpeg.json.php, specifically looking for attempts to supply unexpected paths in the avideoRelativePath parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block requests containing path traversal sequences or unauthorized tokens targeting the affected script.

Public Exploit Available: No

This vulnerability is critical due to the lack of required authentication and the impact of arbitrary file write capabilities. Administrators must prioritize the identification of all instances of AVideo within their environment and apply vendor-supplied updates immediately upon release. If patching is delayed, disabling the vulnerable functionality or restricting network access to the affected script is required to mitigate the risk of compromise.