CVE-2026-40909 Details

A path traversal vulnerability has been identified in WWBN AVideo versions through 29.0. The issue arises in the locale save endpoint (locale/save.php), where the file path is constructed by directly appending the 'flag' parameter from the POST request into the path without proper sanitization. This allows an admin attacker, or any user who can cross-site request forgery (CSRF) an admin, to escape the locale directory and write arbitrary PHP files to any writable location on the filesystem, leading to remote code execution. The vulnerability is amplified by the absence of CSRF token validation, as AVideo's session cookies are set to 'SameSite=None', enabling cross-site POST requests to include the admin's session cookie.

Users are advised to update to the patched version of WWBN AVideo, which includes validation of the 'flag' parameter to prevent path traversal, as well as CSRF protection. Instructions for updating can be found in the AVideo repository.