AVideo, an open source video platform, contains a flaw in its downloadVideoFromDownloadURL function where remote content is saved to a publicly accessible temporary directory using the original filename and extension, which may be .php. When an attacker provides an invalid resolution parameter, the function terminates early through forbiddenPage(), preventing the temporary file from being moved or deleted. This leaves the PHP file persistently accessible under videos/cache/tmpFile/, allowing the attacker to execute arbitrary PHP code on the server. The weakness is an unrestricted upload of a dangerous file type (CWE‑434).

The vulnerability affects the WWBN AVideo product in all versions up to and including 26.0. Only the encoder module that processes external video URLs is impacted and no other vendors or product lines are reported to be impacted.

The CVSS score of 8.8 indicates a high severity vulnerability that can lead to complete compromise of affected systems. The EPSS score of less than 1% suggests low current exploit activity, and the vulnerability is not listed in the CISA KEV catalog. An attacker can likely exploit this flaw by sending a crafted HTTP request to downloadVideoFromDownloadURL with a malicious URL that ends with a .php extension and an invalid resolution value. Based on the description it is inferred that the endpoint may be accessible without authentication, meaning that an unauthenticated attacker can trigger the vulnerability. Successful exploitation allows an attacker to upload arbitrary PHP payloads that the web server will execute with the server’s permissions.