SECURITYHIGHCVE-2026-124424

CVE-2026-124424: WWBN AVideo AI Plugin Path Traversal Allows Arbitrary .vtt Write

A path traversal in WWBN AVideo's AI plugin lets any holder of a valid AI token write arbitrary .vtt files through the unsanitized response[lang] parameter.

Dylan H.

Security Team

November 9, 2026
2 min read
CVE-2026-124424: WWBN AVideo AI Plugin Path Traversal Allows Arbitrary .vtt Write

Affected Products

  • WWBN AVideo (plugin/AI/receiveAsync.json.php)

Executive Summary

CVE-2026-124424 is a path traversal vulnerability in WWBN AVideo, rated CVSS 7.1 (High). It sits in plugin/AI/receiveAsync.json.php, where the response[lang] parameter is not sanitized.

Anyone holding a valid AI token can inject traversal sequences and write arbitrary .vtt (WebVTT subtitle) files outside the intended directory.

Vulnerability Details

FieldValue
CVECVE-2026-124424
CVSS7.1
Componentplugin/AI/receiveAsync.json.php
Parameterresponse[lang]
PreconditionValid AI token
ClassPath traversal / arbitrary file write

The attacker sends a type=translation request with a crafted response[lang] value containing traversal sequences. The server uses that value to build the output filename, so the file lands at an attacker-chosen path.

The write is constrained to the .vtt extension, which limits direct code execution. It can still overwrite or plant files in locations the web application did not intend to expose.

Remediation

  1. Update AVideo to the latest release from the WWBN project once a fixed version is available; check the project's repository for the patch status.
  2. Restrict and rotate AI tokens, and issue them only to trusted services.
  3. If the AI plugin is not needed, disable it.
  4. Monitor web server logs for receiveAsync.json.php requests containing .. sequences in response[lang].

References