WWBN AVideo CVE-2026-84478

No special conditions are required for the deletion primitive - remote unauthenticated exploitation is possible against default configurations of WWBN AVideo wherever the application is network-accessible, as the get_api_login_code endpoint accepts unauthenticated requests (PR:N, UI:N in CVSS terms). The key limiting factor is the file extension constraint: only files ending in .log can be deleted, excluding executable binaries, configuration files, and database files from the impact scope. A secondary constraint is OS-level filesystem permissions: the web server process must hold delete rights on the traversal-resolved path, meaning system log files owned by root and not world-writable are protected unless the AVideo process runs with elevated privileges. The information disclosure (file existence probing) primitive is similarly unauthenticated and network-accessible.

The CVSS 4.0 score of 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N reflects low-friction unauthenticated network exploitation, but the impact metrics (VC:L/VI:L/VA:L) appropriately capture the constrained blast radius - only .log files can be deleted, not arbitrary data or executables. Even a mid-sized municipal IT team in gdynia running AVideo for internal media distribution should treat this as a meaningful priority if compliance or audit logging is a regulatory requirement, since log destruction directly impairs incident response and may trigger compliance findings. No EPSS score was provided; KEV status is negative; no public exploit has been identified at time of analysis. The primary real-world risk is an attacker erasing evidence of prior unauthorized access rather than achieving code execution or data exfiltration, placing this in the anti-forensics threat category. The information disclosure component (filesystem probing) adds reconnaissance value that could chain into deeper exploitation. Overall priority: moderate, elevated for deployments where audit integrity is a compliance concern.

An unauthenticated remote attacker sends an HTTP request to the AVideo get_api_login_code endpoint with the code parameter set to a traversal payload such as ../../../../var/log/nginx/access.log, causing the server process to delete the target log file if the web user has write permissions to that path. The attacker can repeat this with different traversal depths and filenames, using response differences to map the server's directory structure and identify sensitive log paths before deleting them. No public exploit code has been identified at time of analysis, but the attack requires only basic HTTP request manipulation and is well within reach of any attacker familiar with path traversal techniques.