high advisory November 11, 2026

WWBN AVideo: Path traversal in ADs plugin (CVE-2026-126804)

WWBN AVideo versions 12.4 through 29.7.1 contain a path traversal vulnerability in the ADs plugin that allows authenticated attackers to delete arbitrary files on the server.

Triage facts

Revision 1

Applicability: AVideo (12.4 through 29.7.1)
Evidence: Unknown
Severity: High
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Nov 11, 22:08 UTC
Detection: 1 rule
Vulnerabilities: 1 CVE
Source quality: A1Likely

WWBN AVideo versions 12.4 through 29.7.1 contain a path traversal vulnerability in the deleteImage.json.php file within the ADs plugin. The vulnerability arises due to improper validation of user-supplied input, specifically the is_regular_user parameter. An authenticated user can manipulate this parameter by injecting path traversal sequences to delete arbitrary files on the system, including critical files such as videos/configuration.php, which can lead to service disruption and potential re-installation of the platform.

Impact

Successful exploitation allows an authenticated attacker to delete arbitrary files. Deletion of critical configuration files such as videos/configuration.php results in the application being taken offline and can re-expose the installation wizard to unauthorized access, potentially leading to full site compromise.

Recommendation

Update WWBN AVideo to a version beyond 29.7.1 to mitigate CVE-2026-126804. Administrators should also audit file system permissions and monitor for unauthorized deletions in the application directory.

Immediate actions

Inventory all public-facing AVideo instances

IT Operations 24h

Upgrade affected AVideo instances to a version beyond 29.7.1

IT Operations 72h

Threat Hunt

Search web server logs for suspicious parameter manipulation in requests to deleteImage.json.php

T1190 high high confidence convert to detection

Data: web server logs

Detection coverage 1

Detect CVE-2026-126804 Exploitation - Path Traversal in AVideo ADs Plugin

high

Detects attempts to exploit CVE-2026-126804 by monitoring for HTTP requests to the deleteImage.json.php script containing directory traversal sequences in the is_regular_user parameter.

sigma tactics: impact, initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →