WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.php
Affects AVideo up to and including 29.7.0 when the free bundled AI plugin is enabled and an attacker holds any valid AI token. No fixed version is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Requires the free bundled AI plugin to be enabled Attacker must hold any valid AI token Affects AVideo versions up to and including 29.7.0
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 20/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized response[lang] parameter. Attackers can send a type=translation request with a crafted lang value to plant attacker-controlled content in the webroot or overwrite other users' subtitle files.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.1/10CVSS 7.1
- No patch5/5No patch listed yet
What would change the score
- Would score about 70 if added to CISA KEV
- Would score about 65 if CISA's SSVC rates exploitation active
- Would score about 27 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Requires the free bundled AI plugin to be enabled Attacker must hold any valid AI token Affects AVideo versions up to and including 29.7.0Workaround: The checked facts give no workaround. The only limit the facts support is turning off the free bundled AI plugin, since the flaw requires it to be enabled.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- WWBN AVideo
through 29.7.0
Evidence 2
- Advisory
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-124424
Is CVE-2026-124424 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A path traversal flaw in receiveAsync.json.php lets a holder of any valid AI token create or overwrite .vtt files at arbitrary locations the web server user can write to, with attacker-controlled content. This can plant content in the webroot or overwrite other users' subtitle files.Source: github.com, vulncheck.com
Which versions are affected by CVE-2026-124424?
AVideo: through 29.7.0.Source: cve.now feed data
Am I affected, and how do I check?
AVideo versions up to and including 29.7.0 are affected, and only when the free bundled AI plugin is enabled. Check your installed AVideo version and whether the bundled AI plugin is enabled.Source: github.com, vulncheck.com
How do I fix CVE-2026-124424?
The checked facts list no fixed version, so no upgrade target can be confirmed. Plan to update to a release that fixes this once one is available.Source: github.com, vulncheck.com
What if there's no patch?
The checked facts give no workaround. The only limit the facts support is turning off the free bundled AI plugin, since the flaw requires it to be enabled.Source: github.com, vulncheck.com