CyberRota Analysis
AI-GeneratedAVideo is vulnerable to a critical path traversal flaw that enables unauthenticated attackers to write files to arbitrary locations by manipulating the avideoRelativePath parameter. This vulnerability allows attackers to bypass authentication by replaying previously issued ciphertext as a notifyCode token, potentially compromising the application and its data. Organizations using AVideo should prioritize immediate remediation to prevent unauthorized file access and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.