CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-86189 — WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php th...

·Source: NIST NVD

Updated:

Executive Summary

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the applicatio

Analysis

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories. CVSS Score: 9.8. Published: 2026-09-05T13:18:14.000.

Indicators of Compromise (1)

CVE (1)
CVE-2026-86189
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 5, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-86149 — A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some...

A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be initiated remotely.

CVE-2026-86149
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-86148 — A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability...

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.

CVE-2026-86148
NIST NVD
MEDIUMVulnerability

French Police Arrest Suspected ZeroBytes Hacker Over Tax Data Theft

Waqas reports: French authorities have detained an 18-year-old man suspected of belonging to ZeroBytes, a hacking group that claimed responsibility for several attacks targeting French government services and companies. The Paris prosecutor’s office disclosed the case on September 4, according to reports from French media. However, the suspect was arrested on August 18, formally placed... Source

DataBreaches.net