CVE-2026-40909

WWBN AVideo versions 29.0 and prior contain a critical path traversal vulnerability in the locale save endpoint that allows unauthenticated attackers with admin privileges to write arbitrary PHP files to the filesystem. The vulnerability stems from insufficient input sanitization of the $_POST['flag'] parameter, which is directly concatenated into file paths without validation before being written to disk via fwrite(). The vulnerability carries a CVSS score of 8.7 (HIGH) due to its network accessibility, low attack complexity, and high impact on confidentiality and integrity. While exploitation requires high privileges (admin access), the absence of CSRF token validation and the use of SameSite=None cookies significantly lowers the practical barrier to exploitation, as an attacker could leverage CSRF techniques to trick an admin into triggering the malicious request. There is no evidence of active exploitation in the wild, and this vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.001 indicates extremely low current exploitation probability. Commit 57f89ffbc27d37c9d9dd727212334846e78ac21a addresses the issue and should be applied immediately to all affected WWBN AVideo installations.