Path traversal in AVideo - CVE-2026-40909

Vulnerability details

The vulnerability allows a remote privileged user to write arbitrary PHP files outside the locale directory and execute arbitrary code.

The vulnerability exists due to path traversal in AVideo's locale/save.php when concatenating unvalidated flag values into file paths and writing code verbatim, compounded by missing CSRF validation and SameSite=None cookies. A remote privileged user can submit flag=../../webshell with code=$t["x"]=1;?><?php system($_GET["c"]); directly, or induce an administrator to submit these parameters through a malicious page, then request the resulting file in a writable web-accessible directory to execute arbitrary code.

Affected software

How to mitigate CVE-2026-40909

External References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-6rc6-p838-686f

Related Security Bulletins

• Multiple vulnerabilities in AVideo