Vulnerability Description
AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/WWBN/AVideo/commit/1b55a9b3c4911d2f31594ce2e60566c70c6b95e8
- https://github.com/WWBN/AVideo/security/advisories/GHSA-v7p7-jccx-h37c
- https://www.vulncheck.com/advisories/avideo-unauthenticated-arbitrary-file-write
- https://github.com/WWBN/AVideo/security/advisories/GHSA-v7p7-jccx-h37c
FAQ
What is CVE-2026-72748?
CVE-2026-72748 is a vulnerability with a CVSS score of 9.1 (CRITICAL). AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server fi...
How severe is CVE-2026-72748?
CVE-2026-72748 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-72748?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.