{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/avideo-12.4-through-29.7.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-126804"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AVideo (12.4 through 29.7.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WWBN"],"content_html":"\u003cp\u003eWWBN AVideo versions 12.4 through 29.7.1 contain a path traversal vulnerability in the deleteImage.json.php file within the ADs plugin. The vulnerability arises due to improper validation of user-supplied input, specifically the is_regular_user parameter. An authenticated user can manipulate this parameter by injecting path traversal sequences to delete arbitrary files on the system, including critical files such as videos/configuration.php, which can lead to service disruption and potential re-installation of the platform.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to delete arbitrary files. Deletion of critical configuration files such as videos/configuration.php results in the application being taken offline and can re-expose the installation wizard to unauthorized access, potentially leading to full site compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate WWBN AVideo to a version beyond 29.7.1 to mitigate CVE-2026-126804. Administrators should also audit file system permissions and monitor for unauthorized deletions in the application directory.\u003c/p\u003e\n","date_modified":"2026-11-11T22:08:52Z","date_published":"2026-11-11T22:08:52Z","id":"https://feed.craftedsignal.io/briefs/2026-11-wwbn-avideo-path-traversal-cve-2026-126804/","summary":"WWBN AVideo versions 12.4 through 29.7.1 contain a path traversal vulnerability in the ADs plugin that allows authenticated attackers to delete arbitrary files on the server.","title":"WWBN AVideo: Path traversal in ADs plugin (CVE-2026-126804)","url":"https://feed.craftedsignal.io/briefs/2026-11-wwbn-avideo-path-traversal-cve-2026-126804/"}],"language":"en","title":"CraftedSignal Threat Feed - AVideo (12.4 Through 29.7.1)","version":"https://jsonfeed.org/version/1.1"}