Unauthenticated Arbitrary File Write in AVideo

AVideo, an open-source video platform, contains a critical vulnerability (CVE-2026-72748) in the aVideoEncoderChunk.json.php endpoint. This vulnerability allows remote, unauthenticated attackers to perform an arbitrary file write to the server's filesystem using HTTP PUT requests. The flaw permits the upload of files up to 4 GB in size. This can be used by attackers to exhaust server disk space (causing a denial-of-service condition), poison the video encoding pipeline, or, if chained with local file inclusion (LFI) vulnerabilities, achieve remote code execution. Defenders should prioritize patching or restricting access to the affected endpoint immediately.

Attack Chain

1. Attacker identifies an AVideo instance reachable over the network.
2. Attacker probes the target for the presence of the aVideoEncoderChunk.json.php endpoint.
3. Attacker sends a crafted HTTP PUT request to the target endpoint without providing authentication credentials.
4. The vulnerable endpoint accepts the payload, writing it to the server's local filesystem.
5. Attacker iterates the request to maximize disk space usage, inducing a denial-of-service state.
6. Attacker overwrites existing application logic or uploads a web shell to the server.
7. Attacker executes the uploaded payload to gain arbitrary code execution on the underlying host.

Impact

Successful exploitation of CVE-2026-72748 can result in total compromise of the AVideo server. Potential impacts include complete loss of availability through disk exhaustion, unauthorized data modification via pipeline poisoning, and full system takeover via remote code execution. Organizations using AVideo version 29.0 and below are susceptible to these risks.

Recommendation

• Update AVideo to the latest patched version available from the WWBN repository to remediate CVE-2026-72748.
• Apply the vendor-provided security patch immediately: https://github.com/WWBN/AVideo/commit/1b55a9b3c4911d2f31594ce2e60566c70c6b95e8
• Monitor web server logs for HTTP PUT requests targeting aVideoEncoderChunk.json.php from unauthorized or unexpected IP addresses.
• Restrict access to the aVideoEncoderChunk.json.php endpoint at the web application firewall (WAF) or ingress proxy level to authenticated users only.