WWBN AVideo EUVD-2026-72010

Exploitation requires only network reachability of the AVideo web application and possession of any one valid notifyCode ciphertext previously issued by the target (or a compatible instance), since it is replayed without validation - no user credentials, no user interaction, and default configurations are affected. The limiting factors are: the notify.ffmpeg.json.php endpoint must be internet/network reachable and not blocked by an upstream WAF/allowlist, and the attacker must obtain at least one previously issued ciphertext to use as the replay token; successful RCE additionally depends on the webroot allowing PHP execution of the written file.

This is a genuine high-priority issue, not a paper-tiger high score. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) is internally consistent with the description: fully remote, no authentication, no user interaction, and a write-anywhere primitive into a PHP webroot yields code execution - so high confidentiality, integrity, and availability impact are all defensible. The replay-token bypass removes the only gating control, so exploitation is automatable once the request shape is known. No EPSS score, KEV listing, or public PoC is provided in the input, so exploitation status is currently 'no public exploit identified at time of analysis' - the risk is driven by ease of exploitation and impact rather than by confirmed in-the-wild activity. The main tempering factor is deployment footprint: AVideo is a niche self-hosted platform, so widespread mass exploitation is less likely than targeted attacks against exposed instances.

An attacker captures or reuses any previously issued AVideo notifyCode ciphertext, then sends an unauthenticated POST to notify.ffmpeg.json.php with avideoRelativePath set to a traversal path targeting the webroot and a PHP payload as the written content. Because the token is decrypted but never validated, the request is accepted and a webshell is written to a web-accessible directory, which the attacker then requests to achieve remote code execution as the web server user.