Attack Chain

1. Attacker identifies an AVideo instance reachable over the network.
2. Attacker probes the target for the presence of the aVideoEncoderChunk.json.php endpoint.
3. Attacker sends a crafted HTTP PUT request to the target endpoint without providing authentication credentials.
4. The vulnerable endpoint accepts the payload, writing it to the server's local filesystem.
5. Attacker iterates the request to maximize disk space usage, inducing a denial-of-service state.
6. Attacker overwrites existing application logic or uploads a web shell to the server.
7. Attacker executes the uploaded payload to gain arbitrary code execution on the underlying host.

Impact

Successful exploitation of CVE-2026-72748 can result in total compromise of the AVideo server. Potential impacts include complete loss of availability through disk exhaustion, unauthorized data modification via pipeline poisoning, and full system takeover via remote code execution. Organizations using AVideo version 29.0 and below are susceptible to these risks.

Recommendation

• Update AVideo to the latest patched version available from the WWBN repository to remediate CVE-2026-72748.
• Apply the vendor-provided security patch immediately: https://github.com/WWBN/AVideo/commit/1b55a9b3c4911d2f31594ce2e60566c70c6b95e8
• Monitor web server logs for HTTP PUT requests targeting aVideoEncoderChunk.json.php from unauthorized or unexpected IP addresses.
• Restrict access to the aVideoEncoderChunk.json.php endpoint at the web application firewall (WAF) or ingress proxy level to authenticated users only.