The vulnerability occurs in the ImageGallery::saveFile() method of the AVideo platform. File uploads are validated with MIME type detection, but the saved filename extension is taken directly from the original filename without an allowlist. An attacker can upload a polyglot file that contains valid JPEG bytes followed by PHP code and give it a .php extension. The MIME check passes, but the file is written to a web‑accessible directory as an executable .php file, allowing the attacker to run arbitrary code on the server. This represents a remote code execution flaw (CWE‑434) that compromises confidentiality, integrity, and availability of the host system.

The flaw affects the open‑source AVideo video platform from WWBN in all releases up to and including version 26.0. No higher versions have been confirmed to contain the vulnerability.

The CVSS score is 8.8, indicating high severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw lies in a public file‑upload endpoint that accepts content from unauthenticated users, an attacker could potentially exploit it at any time by crafting the described polyglot upload. The risk is mitigated with the availability of a patch.