WWBN AVideo CVE-2026-40909

Requires authenticated session with administrator privileges (PR:H), but effectively bypassable via CSRF attack against admin users. Specific prerequisites: victim AVideo instance must use SameSite=None cookie configuration (default in versions ≤29.0) AND attacker must social-engineer an authenticated admin to visit malicious cross-origin page while logged into AVideo, OR attacker must possess stolen/hijacked admin credentials. The locale/save.php endpoint must be network-accessible to the attacker or their CSRF victim. No non-default configuration required - vulnerability exists in standard installations. Exploitation is limited to write locations where the web server process has filesystem write permissions, typically the AVideo installation directory and system temp paths. User interaction is required only for CSRF attack chain; direct exploitation with stolen admin credentials requires no user interaction (UI:N per CVSS).

Real-world risk assessment reveals moderate-to-high priority depending on deployment context. CVSS 8.7 (AV:N/AC:L/PR:H/UI:N/S:C) accurately reflects network-based attack vector with low complexity but requires high privileges (admin access). The Changed scope indicates impact beyond the vulnerable component. However, the CSRF vector significantly lowers the effective privilege barrier - any attacker who can social-engineer an admin to visit a malicious page can trigger exploitation without stolen credentials. No EPSS score or CISA KEV listing provided, suggesting limited evidence of active exploitation at time of analysis. Publicly available exploit code exists (PoC implicit in detailed GitHub Security Advisory GHSA-6rc6-p838-686f). Priority should be elevated for internet-facing AVideo deployments where admin sessions may be exposed to CSRF attacks, but reduced for internal deployments with strict admin access controls and network segmentation. The combination of path traversal + arbitrary file write + PHP execution makes this a genuine RCE risk, not merely a file disclosure issue.

An attacker crafts a malicious HTML page containing a hidden form that POSTs to the victim's AVideo instance at /locale/save.php with flag=../../../../../../var/www/html/shell.php and code containing PHP backdoor code. When an authenticated AVideo administrator visits the attacker's page, their browser automatically submits the form with their admin session cookies due to SameSite=None. The vulnerable endpoint writes the PHP shell to the web root without path validation. The attacker then accesses /shell.php directly via HTTP to execute arbitrary system commands as the web server user. Publicly available exploit code exists per GitHub Security Advisory GHSA-6rc6-p838-686f.