AVideo (12.4 Through 29.7.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/avideo-12.4-through-29.7.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 22:08:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWWBN AVideo: Path traversal in ADs plugin (CVE-2026-126804)https://feed.craftedsignal.io/briefs/2026-11-wwbn-avideo-path-traversal-cve-2026-126804/Wed, 11 Nov 2026 22:08:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-wwbn-avideo-path-traversal-cve-2026-126804/WWBN AVideo versions 12.4 through 29.7.1 contain a path traversal vulnerability in the ADs plugin that allows authenticated attackers to delete arbitrary files on the server.WWBN AVideo versions 12.4 through 29.7.1 contain a path traversal vulnerability in the deleteImage.json.php file within the ADs plugin. The vulnerability arises due to improper validation of user-supplied input, specifically the is_regular_user parameter. An authenticated user can manipulate this parameter by injecting path traversal sequences to delete arbitrary files on the system, including critical files such as videos/configuration.php, which can lead to service disruption and potential re-installation of the platform.

Impact

Successful exploitation allows an authenticated attacker to delete arbitrary files. Deletion of critical configuration files such as videos/configuration.php results in the application being taken offline and can re-expose the installation wizard to unauthorized access, potentially leading to full site compromise.

Recommendation

Update WWBN AVideo to a version beyond 29.7.1 to mitigate CVE-2026-126804. Administrators should also audit file system permissions and monitor for unauthorized deletions in the application directory.

]]>highadvisory