CVE-2026-40909— WWBN AVideo 安全漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing Application新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-40909の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
ソース: NVD (National Vulnerability Database)
脆弱性説明
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint (`locale/save.php`) constructs a file path by directly concatenating `$_POST['flag']` into the path at line 30 without any sanitization. The `$_POST['code']` parameter is then written verbatim to that path via `fwrite()` at line 40. An admin attacker (or any user who can CSRF an admin, since no CSRF token is checked and cookies use `SameSite=None`) can traverse out of the `locale/` directory and write arbitrary `.php` files to any writable location on the filesystem, achieving Remote Code Execution. Commit 57f89ffbc27d37c9d9dd727212334846e78ac21a fixes the issue.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
对路径名的限制不恰当(路径遍历)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
WWBN AVideo 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
WWBN AVideo是WWBN团队的一个由PHP编写的视频平台建站系统。 WWBN AVideo 29.0及之前版本存在安全漏洞，该漏洞源于locale/save.php中直接拼接$_POST[flag]构建文件路径且未清理，并通过fwrite将$_POST[code]写入该路径，可能导致管理员或通过CSRF的攻击者路径遍历并写入任意PHP文件，实现远程代码执行。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-40909の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-40909のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-40909 厂商安全公告 (1)
Same Patch Batch · WWBN · 2026-04-21 · 19 CVEs total
| CVE-2026-40911 | 10.0 CRITICAL | WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaSc |
| CVE-2026-41064 | 9.3 CRITICAL | AVideo has an incomplete fix for CVE-2026-33502 (Command Injection) |
| CVE-2026-41055 | 8.6 HIGH | AVideo has an incomplete fix for CVE-2026-33039 (SSRF) |
| CVE-2026-40925 | 8.3 HIGH | WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeo |
| CVE-2026-41056 | 8.1 HIGH | AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enable |
| CVE-2026-41058 | 8.1 HIGH | AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo |
| CVE-2026-41060 | 7.7 HIGH | AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL |
| CVE-2026-40926 | 7.1 HIGH | WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Scrip |
| CVE-2026-41057 | 7.1 HIGH | AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) t |
| CVE-2026-40907 | 6.5 MEDIUM | WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys |
| CVE-2026-41062 | 6.5 MEDIUM | WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in Rec |
| CVE-2026-40928 | 5.4 MEDIUM | AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Cr |
| CVE-2026-40929 | 5.4 MEDIUM | WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comme |
| CVE-2026-41063 | 5.4 MEDIUM | WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) |
| CVE-2026-41061 | 5.4 MEDIUM | WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiv |
| CVE-2026-40908 | 5.3 MEDIUM | WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes De |
| CVE-2026-40935 | 5.3 MEDIUM | WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token |
| CVE-2026-41304 | WWBN AVideo vulnerable to RCE caused by clonesite plugin |
IV. 関連脆弱性
同じ製品: AVideo
- CVE-2026-64626
AVideo Encoder downloadURL SSRF via unpinned retry fallback - CVE-2026-64625
AVideo before 29.0 OS Command Injection via execAsync - CVE-2026-33731
AVideo has an Authorize.Net Webhook Signature Bypass that En - CVE-2026-55173
AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegComm - CVE-2026-33692
AVideo Has Unauthenticated .env File Exposure via Official D
同じベンダー: WWBN
- CVE-2026-64626
AVideo Encoder downloadURL SSRF via unpinned retry fallback - CVE-2026-64625
AVideo before 29.0 OS Command Injection via execAsync - CVE-2026-33731
AVideo has an Authorize.Net Webhook Signature Bypass that En - CVE-2026-55173
AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegComm - CVE-2026-33692
AVideo Has Unauthenticated .env File Exposure via Official D
同じ弱点: CWE-22
- CVE-2026-56844
Veeam Software Appliance本地提权漏洞 - CVE-2026-47731
NASA AMMOS Instrument Toolkit: Path traversal resulting in a - CVE-2026-47425
Rattler vulnerable to entry-point path traversal in noarch:p - CVE-2026-15724
Path traversal in Progress ShareFile Storage Zones Controlle - CVE-2026-15791
LLB file operation can be tricked to remove /tmp directory c
V. CVE-2026-40909へのコメント
まだコメントはありません