AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation poc

Automatable yes

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
WWBN AVideo unaffected
Version Status Constraints
29.0 affected —

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Wwbn Subscribe
Avideo Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/WWBN/AVideo/commit/1b55a9b3c4911d2f31594ce2e60566c70c6b95e8 cve-icon cve-icon
https://github.com/WWBN/AVideo/security/advisories/GHSA-v7p7-jccx-h37c cve-icon cve-icon cve-icon
https://www.vulncheck.com/advisories/avideo-unauthenticated-arbitrary-file-write-via-avideoencoderchunk-json-php cve-icon cve-icon
History

Tue, 11 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.
Title AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php
First Time appeared Wwbn
Wwbn avideo
Weaknesses CWE-306
CPEs cpe:2.3:a:wwbn:avideo:14.2:*:*:*:*:*:*:*
cpe:2.3:a:wwbn:avideo:14.3.1:*:*:*:*:*:*:*
cpe:2.3:a:wwbn:avideo:14.3:*:*:*:*:*:*:*
cpe:2.3:a:wwbn:avideo:14.4:*:*:*:*:*:*:*
cpe:2.3:a:wwbn:avideo:18.0:*:*:*:*:*:*:*
cpe:2.3:a:wwbn:avideo:21.0:*:*:*:*:*:*:*
cpe:2.3:a:wwbn:avideo:22.0:*:*:*:*:*:*:*
cpe:2.3:a:wwbn:avideo:24.0:*:*:*:*:*:*:*
cpe:2.3:a:wwbn:avideo:25.0:*:*:*:*:*:*:*
cpe:2.3:a:wwbn:avideo:26.0:*:*:*:*:*:*:*
cpe:2.3:a:wwbn:avideo:29.0:*:*:*:*:*:*:*
Vendors & Products Wwbn
Wwbn avideo
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-11T14:12:04.222Z

Reserved: 2026-08-10T13:53:42.482Z

Link: CVE-2026-72748

cve-icon Vulnrichment

Updated: 2026-08-11T14:08:59.188Z

cve-icon NVD

Status : Received

Published: 2026-08-11T13:19:05.813

Modified: 2026-08-11T15:17:35.623

Link: CVE-2026-72748

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses