Vulnerability · Published Aug 11, 2026 · Assigned by VulnCheck

CVE-2026-72748AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php

Critical 9.1

In plain English

A critical-severity missing authentication in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)1.2%top 31.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	29.0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

GitHub Security Advisory (GHSA-v7p7-jccx-h37c) vendor-advisory
https://github.com/WWBN/AVideo/commit/1b55a9b3c4911d2f31594ce2e60566c70c6b95e8 patch
VulnCheck Advisory: AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php third-party-advisory