UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126804

WWBN AVideo 12.4 through 29.7.1 Path Traversal File Deletion via deleteImage.json.php

Severity
High 7.2
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Path traversal (CWE-22)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Change data · Take it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Sources
CVE Program

Description

WWBN AVideo 12.4 through 29.7.1 contains a path traversal vulnerability in the ADs plugin deleteImage.json.php that allows authenticated users with custom ads to delete arbitrary files. Attackers can set the unvalidated is_regular_user parameter to another user's id or ../ sequences to delete other users' ads or files like videos/configuration.php, taking the site offline and re-exposing the installer.

From the CVE Program.

Affected software

SoftwareAffected versions
AVideoServers and applications · cna:wwbn|avideo
  • From 12.4 up to 29.7.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126804