Is CVE-2026-86189 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86189?

CVE-2026-86189 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-86189

Description

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.