CVE-2026-72748
CriticalCVSS 9.1Summary
AVideo has an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint, allowing remote attackers to write up to 4 GB of arbitrary content via HTTP PUT without authentication.
Risk Assessment
Attackers can exhaust disk space causing DoS, poison the video encoding pipeline, or chain with local file inclusion for remote code execution.
Recommendation
Apply vendor patches or restrict access to this endpoint. Monitor disk usage and file integrity.
Original NVD description (English source)
AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.