What is the CVSS score of CVE-2026-40909?

CVE-2026-40909 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

WWBN AVideo CVE-2026-40909

EUVD-2026-24288 HIGH

Path Traversal (CWE-22)

2026-04-21 GitHub_M

GHSA-6rc6-p838-686f

PHP Path Traversal CSRF RCE

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 21:22 vuln.today

cvss_changed

Analysis Generated

Apr 21, 2026 - 20:52 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 20:00 euvd

EUVD-2026-24288

Analysis Generated

Apr 21, 2026 - 20:00 vuln.today

CVE Published

Apr 21, 2026 - 19:54 nvd

HIGH 8.7

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint (locale/save.php) constructs a file path by directly concatenating $_POST['flag'] into the path at line 30 without any sanitization. The $_POST['code'] parameter is then written verbatim to that path via fwrite() at line 40. An admin attacker (or any user who can CSRF an admin, since no CSRF token is checked and cookies use SameSite=None) can traverse out of the locale/ directory and write arbitrary .php files to any writable location on the filesystem, achieving Remote Code Execution. Commit 57f89ffbc27d37c9d9dd727212334846e78ac21a fixes the issue.

AnalysisAI

Path traversal in WWBN AVideo 29.0 and earlier allows authenticated administrators (or CSRF-tricked admins) to write arbitrary PHP files anywhere on the server filesystem, achieving remote code execution. The locale save endpoint fails to sanitize the 'flag' parameter used in file path construction and lacks CSRF protection despite SameSite=None cookies, enabling straightforward exploitation by lower-privilege attackers who chain CSRF against admin sessions. Upstream fix committed to GitHub (57f89ffb) but released patched version not independently confirmed. CVSS 8.7 reflects high impact but requires privileged access - real-world risk depends heavily on admin session hijacking opportunities.

Technical ContextAI

The vulnerability exists in the locale/save.php endpoint of WWBN AVideo, an open-source video streaming platform written in PHP. The code directly concatenates unsanitized user input from $_POST['flag'] into a file path construction (line 30), then writes arbitrary content from $_POST['code'] to that path via fwrite() (line 40). This constitutes a classic CWE-22 (Path Traversal) weakness that escalates to arbitrary file write. The absence of CSRF token validation combined with SameSite=None cookie attributes creates a CSRF exposure, allowing attackers to exploit this via cross-site requests against authenticated admin sessions. The affected product is identified by CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* covering all versions through 29.0. PHP's fwrite() function will create executable .php files with attacker-controlled content at traversal-specified locations, enabling immediate code execution when accessed via web request.

RemediationAI

Apply the upstream fix by updating to a version incorporating commit 57f89ffbc27d37c9d9dd727212334846e78ac21a, available at https://github.com/WWBN/AVideo/commit/57f89ffbc27d37c9d9dd727212334846e78ac21a. Note that a vendor-tagged release version incorporating this fix is not independently confirmed at time of analysis - verify current version status with WWBN project before deployment. If immediate patching is not feasible, implement compensating controls: restrict access to locale/save.php to localhost-only via web server configuration (e.g., Apache 'Require ip 127.0.0.1' or nginx 'allow 127.0.0.1; deny all;'), recognizing this breaks remote administration workflows. Alternatively, implement application firewall rules blocking requests with '../' or absolute path characters in the 'flag' parameter, though this may be bypassable via URL encoding. Deploy CSRF tokens site-wide and change cookie SameSite attribute from None to Strict, accepting that this breaks legitimate cross-origin admin workflows. Monitor web server logs for POST requests to locale/save.php with unusual 'flag' values or from unexpected source IPs.