WWBN AVideo versions 29.0 and earlier contain a path‑traversal flaw in the locale/save.php endpoint. The application concatenates the POST parameter flag directly into a file path and writes the POST parameter code verbatim. This lets an attacker who can act as an administrator or who can CSRF an admin session construct a path that exits the locale directory and create arbitrary .php files in any web‑accessible, writable directory, effectively executing code on the host.

The vulnerable component is present in the WWBN AVideo open‑source video platform. Versions 29.0 and all earlier releases are affected. Users running those releases should verify the 57f89f… patch or update to the latest release (>=30.0).

The flaw receives a CVSS score of 8.7, indicating high severity. EPSS data was not provided, and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to possess administrative privileges or the ability to CSRF an admin session, but no additional preconditions are documented. Once exploited, an attacker gains remote code execution over the affected server.