WWBN AVideo contains a path traversal flaw in notify.ffmpeg.json.php that lets anyone craft an avideoRelativePath parameter to write a file to any location inside the application’s file system. The notifyCode token that provides authentication is decrypted but never validated, so attackers can replay a previously issued ciphertext to bypass all access checks. By creating or overwriting files in the application root or subdirectories, an attacker can drop scripts, configuration files or other malicious payloads that are then executable through the web server or the AV application, giving full remote code execution capabilities.

The vulnerability affects installations of the WWBN AVideo platform, regardless of version. Specific version data is not supplied in the advisory.

The CVSS score of 9.3 categorises this flaw as critical, indicating a high likelihood of successful exploitation and severe impact. The EPSS score is not available, so the current probability of active exploitation is unknown, but the absence of a KEV listing does not reduce the potential threat. Given the unauthenticated nature of the attack and the ability to write arbitrary files, the likely attack vector is a remote HTTP request to the vulnerable endpoint, with no prerequisite authentication. The exploitation requires only sending an HTTP request containing a crafted avideoRelativePath and replayed notifyCode token, after which any file, including executable code, can be placed in the application’s file system.