CVE-2026-72748CWE-306

CVE-2026-72748

Critical · published August 11, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
67.7
In the wild
Unconfirmed
What it is

AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01189 · 67.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-11T17:19Z
References (4)
https://github.com/WWBN/AVideo/commit/1b55a9b3c4911d2f31594ce2e60566c70c6b95e8 · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-v7p7-jccx-h37c · [email protected]https://www.vulncheck.com/advisories/avideo-unauthenticated-arbitrary-file-write-via-avideoencoderchunk-json-php · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-v7p7-jccx-h37c · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 AUG 12:17Z
    AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php
    cvelistv5