ZeroDay Findings
Sign inSign up

Findings

CVE-2026-40909

WWBN AVideo is an open source video platform.

Published Apr 21, 2026 · updated Jun 17, 2026 · wwbn avideo

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint ( ) constructs a file path by directly concatenating into the path at line 30 without any sanitization. The parameter is then written verbatim to that path via at line 40. An admin attacker (or any user who can CSRF an admin, since no CSRF token is checked and cookies use ) can traverse out of the directory and write arbitrary files to any writable location on the filesystem, achieving Remote Code Execution. Commit 57f89ffbc27d37c9d9dd727212334846e78ac21a fixes the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 21, 2026 · NIST NVD

    Detected

    WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint ( ) constructs a file path by directly concatenating into the path at line 30 without any sanitization. The parameter is then written verbatim to that path via at line 40. An admin attacker (or any user who can CSRF an admin, since no CSRF token is checked and cookies use ) can traverse out of the di

  2. Jun 17, 2026 · NIST NVD

    Updated

    WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint ( ) constructs a file path by directly concatenating into the path at line 30 without any sanitization. The parameter is then written verbatim to that path via at line 40. An admin attacker (or any user who can CSRF an admin, since no CSRF token is checked and cookies use ) can traverse out of the di

Affected

  • cpe wwbn/avideoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-40909

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-40909

    WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint ( ) constructs a file path by directly concatenating into the path at line 30 without any sanitization. The parameter is then writt

    nvd.nist.gov

References