AVideo CVE-2026-72748

The endpoint objects/aVideoEncoderChunk.json.php must be reachable from the attacker's network position over HTTP or HTTPS - no special network position, VPN, or adjacent-network access is required for a publicly exposed instance. Prior to patching, no authentication header, session cookie, token, or credential of any kind was required; any HTTP PUT to this endpoint was processed. The base impact (disk exhaustion DoS) requires no secondary conditions. The worst-case impact (RCE) additionally requires either a local file inclusion vulnerability elsewhere in AVideo that can be triggered to include the written file, or the ability to write into a web-accessible directory where PHP execution is enabled. The provided CVSS 4.0 vector's AV:L metric contradicts the described network-accessible attack surface - defenders should treat this as a network-reachable unauthenticated flaw until the vendor issues a corrected vector.

The provided CVSS 4.0 vector (AV:L/VI:N/VC:H) is materially inconsistent with the vulnerability as described and must not be used as-is for prioritization decisions. The description explicitly states remote attackers exploit this via HTTP PUT - the attack vector is plainly Network (AV:N), not Local (AV:L). Additionally, the vector reports VI:N (no integrity impact) and VC:H (high confidentiality impact), which is the inverse of what an arbitrary FILE WRITE vulnerability produces: integrity is the primary impact, not confidentiality. This CVSS data appears to contain input errors, and defenders relying on it will systematically underestimate the real risk. Correcting for these inconsistencies, the real-world risk profile is significantly higher than the nominal 6.9 score suggests: AC:L/PR:N/UI:N means any unauthenticated actor on the internet can exploit this against a publicly reachable AVideo instance with a trivial HTTP client. No EPSS data was provided and no CISA KEV listing is present, so exploitation probability is unquantified from external signals; however, the attack complexity is so low that even operators with limited security resources should treat patching as urgent. The RCE chain requires an additional LFI condition, which moderates the severity of the worst-case scenario somewhat, but disk exhaustion DoS is achievable with no secondary dependency.

An unauthenticated attacker identifies a publicly exposed AVideo instance and sends a crafted HTTP PUT request directly to /objects/aVideoEncoderChunk.json.php, writing a PHP webshell to the server's temp directory or another writable path. If that path is web-accessible or if a local file inclusion vulnerability exists elsewhere in AVideo, the attacker issues a follow-up request to execute the written file, gaining arbitrary code execution under the web server process identity. No public exploit code has been identified at time of analysis, but the attack requires no special tooling beyond a standard HTTP client such as curl.