WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
Date: 2026-04
Affected: composer/wwbn/avideo
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-40909
CWE: CWE-22
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

## Summary The locale save endpoint (`locale/save.php`) constructs a file path by directly concatenating `$_POST['flag']` into the path at line 30 without any sanitization. The `$_POST['code']` parameter is then written verbatim to that path via `fwrite()` at line 40. An admin attacker (or any user who can CSRF an admin, since no CSRF token is checked and cookies use `SameSite=None`) can traverse out of the `locale/` directory and write arbitrary `.php` files to any writable location on the filesystem, achieving Remote Code Execution. ## Details In `locale/save.php`, the vulnerable code path is: ```php // locale/save.php:10 — only auth check, no CSRF token if (!User::isAdmin() || !empty($global['disableAdvancedConfigurations'])) { // ... die(json_encode($obj)); } // locale/save.php:16 — base directory $dir = "{$global['systemRootPath']}locale/"; // locale/save.php:30 — UNSANITIZED path concatenation $file = $dir.($_POST['flag']).".php"; $myfile = fopen($file, "w") or die("Unable to open file!"); // locale/save.php:40 — UNSANITIZED content write fwrite($myfile, $_POST['code']); ``` **Root cause**: `$_POST['flag']` is concatenated directly into the file path with no call to `basename()`, `realpath()`, or any filtering of `../` sequences. A `flag` value like `../../shell` resolves to `{systemRootPath}locale/../../shell.php`, which escapes the locale directory and writes to `{systemRootPath}../shell.php` — the web-accessible parent directory. The file content is


Mitigations:

Architectural layers (MAESTRO):