WWBN AVideo — CVE-2026-86189 (Critical)

Date Sep 5, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product WWBN · AVideo

CVE CVE-2026-86189

Critical vendor advisory CVE-2026-86189

Summary

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in WWBN AVideo. Patch or mitigate promptly. EPSS percentile: 34%.

Operator check

Review CVE-2026-86189 in your asset inventory. Apply patches per vendor guidance and verify AVideo is not exposed. CVSS score: 9.8. EPSS probability: 0.4%; percentile: 34%.

Sources

NVD — CVE-2026-86189 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed