CVE-2026-40909— WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-40909
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
Source: NVD (National Vulnerability Database)
Vulnerability Description
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint (`locale/save.php`) constructs a file path by directly concatenating `$_POST['flag']` into the path at line 30 without any sanitization. The `$_POST['code']` parameter is then written verbatim to that path via `fwrite()` at line 40. An admin attacker (or any user who can CSRF an admin, since no CSRF token is checked and cookies use `SameSite=None`) can traverse out of the `locale/` directory and write arbitrary `.php` files to any writable location on the filesystem, achieving Remote Code Execution. Commit 57f89ffbc27d37c9d9dd727212334846e78ac21a fixes the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
WWBN AVideo 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WWBN AVideo是WWBN团队的一个由PHP编写的视频平台建站系统。 WWBN AVideo 29.0及之前版本存在安全漏洞，该漏洞源于locale/save.php中直接拼接$_POST[flag]构建文件路径且未清理，并通过fwrite将$_POST[code]写入该路径，可能导致管理员或通过CSRF的攻击者路径遍历并写入任意PHP文件，实现远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-40909
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40909
请登录查看更多情报信息。
Same Patch Batch · WWBN · 2026-04-21 · 19 CVEs total
| CVE-2026-40911 | 10.0 CRITICAL | WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaSc |
| CVE-2026-41064 | 9.3 CRITICAL | AVideo has an incomplete fix for CVE-2026-33502 (Command Injection) |
| CVE-2026-41055 | 8.6 HIGH | AVideo has an incomplete fix for CVE-2026-33039 (SSRF) |
| CVE-2026-40925 | 8.3 HIGH | WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeo |
| CVE-2026-41056 | 8.1 HIGH | AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enable |
| CVE-2026-41058 | 8.1 HIGH | AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo |
| CVE-2026-41060 | 7.7 HIGH | AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL |
| CVE-2026-40926 | 7.1 HIGH | WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Scrip |
| CVE-2026-41057 | 7.1 HIGH | AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) t |
| CVE-2026-40907 | 6.5 MEDIUM | WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys |
| CVE-2026-41062 | 6.5 MEDIUM | WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in Rec |
| CVE-2026-40928 | 5.4 MEDIUM | AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Cr |
| CVE-2026-40929 | 5.4 MEDIUM | WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comme |
| CVE-2026-41063 | 5.4 MEDIUM | WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) |
| CVE-2026-41061 | 5.4 MEDIUM | WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiv |
| CVE-2026-40908 | 5.3 MEDIUM | WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes De |
| CVE-2026-40935 | 5.3 MEDIUM | WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token |
| CVE-2026-41304 | WWBN AVideo vulnerable to RCE caused by clonesite plugin |
IV. Related Vulnerabilities
Same product: AVideo
- CVE-2026-41304
WWBN AVideo vulnerable to RCE caused by clonesite plugin - CVE-2026-41064
AVideo has an incomplete fix for CVE-2026-33502 (Command Inj - CVE-2026-41063
WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) - CVE-2026-41062
WWBN/AVideo has an incomplete fix for a directory traversal - CVE-2026-41061
WWBN AVideo Vulnerable to stored XSS via Unanchored Duration
Same vendor: WWBN
- CVE-2026-41304
WWBN AVideo vulnerable to RCE caused by clonesite plugin - CVE-2026-41064
AVideo has an incomplete fix for CVE-2026-33502 (Command Inj - CVE-2026-41063
WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) - CVE-2026-41062
WWBN/AVideo has an incomplete fix for a directory traversal - CVE-2026-41061
WWBN AVideo Vulnerable to stored XSS via Unanchored Duration
Same weakness: CWE-22
- CVE-2026-8274
npitre cramfs-tools Directory cramfsck.c do_directory path t - CVE-2022-50956
WordPress Plugin amministrazione-aperta 3.7.3 Local File Rea - CVE-2026-8215
Industrial Application Software IAS Canias ERP RMI iasReques - CVE-2026-42605
AzuraCast: Path Traversal in `currentDirectory` Parameter En - CVE-2026-42574
apko dirFS has a symlink-following path traversal that allow
V. Comments for CVE-2026-40909
No comments yet