CVE-2026-86189: Critical WWBN AVideo Path Traversal via notify.ffmpeg.json.php — Detection and Remediation Guide

The NVD has published CVE-2026-86189, a CVSS 9.8 (Critical), network-exploitable vulnerability affecting WWBN AVideo, the open-source video sharing and streaming platform. While the headline references ffmpeg, the vulnerable component is not the ffmpeg binary itself — it is AVideo's ffmpeg notification callback endpoint, notify.ffmpeg.json.php, which suffers from a path traversal flaw combined with a broken authentication check. The result: an unauthenticated remote attacker can write files to arbitrary locations within the application root and its subdirectories.

For defenders, arbitrary file write to a web-accessible PHP application directory is functionally equivalent to remote code execution. An attacker who can drop a .php file into the webroot can achieve persistent code execution as the web server user, pivot into the host, and — given that AVideo deployments often sit on media-rich, internet-facing servers — establish a durable foothold inside your network.

If you run AVideo (or its white-labeled derivatives) anywhere in your environment, treat this as an emergency patch cycle.

Technical Analysis

Affected Component

• Product: WWBN AVideo (open-source video platform)
• Vulnerable endpoint: notify.ffmpeg.json.php
• CVE: CVE-2026-86189
• CVSS v3.1: 9.8 (Critical) — Vector: Network / Low complexity / No privileges / No user interaction
• Reference: NVD — CVE-2026-86189

How the Vulnerability Works

The endpoint notify.ffmpeg.json.php exists to receive callbacks from ffmpeg transcoding jobs. Two compounding flaws make it exploitable:

1. Broken authentication via ciphertext replay. The endpoint expects a notifyCode parameter, which is decrypted server-side. However, the decrypted value is never validated against any expected token, session, or job identifier. Any previously issued ciphertext — for example, one observed in a legitimate notification URL — can be replayed as a valid notifyCode, fully bypassing the authentication gate.

2. Path traversal in avideoRelativePath. The endpoint accepts a caller-supplied avideoRelativePath parameter and uses it to determine where to write a file. There is no canonicalization or restriction to an intended upload directory. An attacker supplies traversal sequences (../) or an application-root-relative path, and the server writes attacker-controlled content to that location — including the webroot itself.

Attack Chain (Defender's View)

1. Attacker identifies an internet-exposed AVideo instance (straightforward via fingerprinting the /notify.ffmpeg.json.php path or AVideo page markers).
2. Attacker obtains any valid ciphertext — replaying a previously observed notifyCode is sufficient since it is decrypted but never validated.
3. Attacker sends an HTTP request to notify.ffmpeg.json.php with the replayed notifyCode and a malicious avideoRelativePath such as ../shell.php or a path into a writable subdirectory.
4. The server writes attacker-controlled content to the chosen path. If that path is web-accessible PHP, the attacker now has remote code execution as the web server account (www-data, apache, or nginx).
5. Post-exploitation typically follows: webshell hardening, credential harvesting from AVideo's configuration (database credentials are stored in the application), lateral movement, or deployment of miners/ransomware staging.

Exploitation Status

At the time of writing, the vulnerability is published with full technical detail in the NVD record, meaning exploitation is trivial to operationalize — no memory corruption, no race conditions, just crafted HTTP requests. The endpoint requires no authentication, no user interaction, and the attack works over the network with low complexity. Check the CISA Known Exploited Vulnerabilities catalog and WWBN's GitHub security advisories for current exploitation status, and assume exploitation attempts will begin — if they have not already — as soon as scanners pick up the CVE.

Why This Scores 9.8

Unauthenticated + network-reachable + arbitrary file write into a PHP webroot = reliable RCE in practice. The replay-any-ciphertext authentication bypass removes the only control standing between the internet and the file write primitive.

Detection & Response

What to Look For

The highest-fidelity indicators for this vulnerability are:

• HTTP requests to notify.ffmpeg.json.php containing the avideoRelativePath parameter — especially with traversal sequences (../, ..%2f, %2e%2e, ..\) or paths ending in executable extensions (.php, .phtml, .phar).
• Unexpected file creation in the AVideo application root or web-accessible subdirectories by the web server process — particularly new or modified .php files.
• Requests to notify.ffmpeg.json.php from source IPs that are not your transcoding infrastructure. In a healthy deployment, callbacks should come from localhost or a known encoder host.
• Outbound connections or child processes spawned by the web server user following a suspicious file write (webshell behavior).

Sigma Rules

The first rule targets web server access logs for exploitation attempts against the endpoint. The second targets the webshell drop — the web server process writing PHP files into the webroot, which is the payload moment of this attack.

---
title: WWBN AVideo notify.ffmpeg.json.php Path Traversal Exploitation Attempt
id: 3f8c2a14-7b91-4e65-a2d8-9c1f4b7e5a01
status: experimental
description: Detects HTTP requests to the AVideo notify.ffmpeg.json.php endpoint containing the avideoRelativePath parameter with path traversal sequences or executable file extensions, consistent with CVE-2026-86189 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86189
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: linux
  service: apache
detection:
  selection_endpoint:
    cs-uri-stem|contains: 'notify.ffmpeg.json.php'
  selection_traversal:
    cs-uri-query|contains:
      - 'avideoRelativePath'
      - '../'
      - '..%2f'
      - '%2e%2e'
      - '..\\'
  selection_ext:
    cs-uri-query|contains:
      - '.php'
      - '.phtml'
      - '.phar'
  condition: selection_endpoint and (selection_traversal or selection_ext)
falsepositives:
  - Legitimate ffmpeg transcoding callbacks use avideoRelativePath with normal relative paths; investigate any request combining the endpoint with traversal sequences or script extensions
level: high
---
title: Web Server Process Writing PHP Files to Webroot (Possible AVideo Webshell Drop)
id: 6d1e9b47-2c83-4f58-b7a2-5e9d3a1c8f04
status: experimental
description: Detects the web server process (www-data, apache, nginx) creating PHP script files inside web-accessible directories, consistent with arbitrary file write exploitation of CVE-2026-86189 leading to webshell deployment.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86189
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
  selection_target:
    TargetFilename|contains:
      - '/var/www/'
      - '/html/'
      - '/AVideo/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
  condition: selection_process and selection_target
falsepositives:
  - AVideo application updates and plugin installations; validate against change windows and deployment pipelines
level: high

KQL (Microsoft Sentinel / Defender)

If your AVideo hosts ship Apache/Nginx logs to Sentinel via Syslog/CEF, or if IIS fronts the application, this query hunts for exploitation attempts and follow-on webshell access. It correlates the exploit request with subsequent requests to newly created PHP files from the same source.

let Lookback = 14d;
let ExploitRequests =
    union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated > ago(Lookback)
    | where RequestURL has "notify.ffmpeg.json.php"
    | where RequestURL has_any ("avideoRelativePath", "../", "%2e%2e", "..%2f")
    | project TimeGenerated, SourceIP, RequestURL, RequestMethod, DeviceHostName),
    (Syslog
    | where TimeGenerated > ago(Lookback)
    | where SyslogMessage has "notify.ffmpeg.json.php"
    | where SyslogMessage has_any ("avideoRelativePath", "../", "%2e%2e", "..%2f")
    | extend SourceIP = extract(@'(\d{1,3}\.){3}\d{1,3}', 0, SyslogMessage)
    | project TimeGenerated, SourceIP, RequestURL = SyslogMessage, RequestMethod = "", DeviceHostName = HostName);
ExploitRequests
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), AttemptCount = count(), SampleRequests = make_list(RequestURL, 5) by SourceIP, DeviceHostName
| order by AttemptCount desc;

// Hunt for the webshell payload: web server user writing script files
let Lookback = 14d;
DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessAccountName in~ ("www-data", "apache", "nginx", "iis apppool\\defaultapppool")
| where FolderPath has_any ("/var/www/", "/html/", "AVideo", "inetpub")
| where FileName endswith ".php" or FileName endswith ".phtml"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessAccountName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc;

Velociraptor VQL

This hunt artifact identifies recently created or modified PHP files in the AVideo webroot — the primary forensic artifact of this vulnerability — and cross-references them against baseline expectations.

-- Hunt for recently written PHP files in AVideo webroot (CVE-2026-86189 webshell artifacts)
LET webroots = ('/var/www/html/**', '/var/www/**/AVideo/**')
SELECT FullPath, Size, Mtime, Atime, Ctime,
       read_file(filename=FullPath, length=256) AS FileHeader
FROM foreach(row=webroots,
  query={
    SELECT FullPath, Size, Mtime, Atime, Ctime
    FROM glob(globs=_value)
    WHERE FullPath =~ '\\.(php|phtml|phar)$'
      AND Mtime > now() - 1209600
  })
ORDER BY Mtime DESC

-- Identify outbound connections from the web server process (webshell beacons / post-exploitation)
SELECT Pid, Name, Path, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Name =~ '(apache2|httpd|nginx|php-fpm)'
  AND RemotePort NOT IN (80, 443)
  AND NOT RemoteAddress =~ '^(127\\.|10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)'

Remediation / Verification Script

Use this Bash script on AVideo hosts to (1) identify exposure, (2) search access logs for exploitation attempts, (3) find recently modified PHP files that may be webshells, and (4) apply an emergency Nginx/Apache deny rule as a compensating control until the patch is deployed.

#!/bin/bash
# CVE-2026-86189 — WWBN AVideo notify.ffmpeg.json.php exposure check and hardening
# Run as root on AVideo hosts. Review output before applying config changes.

set -euo pipefail

echo "=== [1] Locating AVideo installations ==="
find /var/www /srv /home -maxdepth 4 -name "notify.ffmpeg.json.php" 2>/dev/null || echo "No AVideo endpoint found in common paths."

echo ""
echo "=== [2] Checking web access logs for exploitation attempts ==="
for log in /var/log/nginx/access.log* /var/log/apache2/access.log* /var/log/httpd/access_log*; do
  [ -f "$log" ] || continue
  echo "--- $log ---"
  zgrep -h "notify.ffmpeg.json.php" "$log" 2>/dev/null \
    | grep -Ei 'avideoRelativePath|\.\./|%2e%2e|\.\.%2f' \
    || echo "  No suspicious requests in $log"
done

echo ""
echo "=== [3] Recently modified PHP files in web directories (possible webshells) ==="
find /var/www -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -mtime -14 2>/dev/null \
  -exec ls -la {} \; | sort -k6,7 || echo "No recent PHP modifications found."

echo ""
echo "=== [4] Emergency compensating control ==="
echo "If unpatched, block external access to the notification endpoint."
echo ""
echo "NGINX — add inside the server block and reload:"
cat <<'EOF'
    location = /notify.ffmpeg.json.php {
        allow 127.0.0.1;
        # Add your transcoding host IPs here, e.g.:
        # allow 10.0.5.20;
        deny all;
    }
EOF

echo ""
echo "APACHE — add to vhost or .htaccess in the AVideo root:"
cat <<'EOF'
<Files "notify.ffmpeg.json.php">
    Require ip 127.0.0.1
    # Require ip 10.0.5.20
</Files>
EOF

echo ""
echo "=== [5] Verify ffmpeg callbacks still work from allowed hosts after applying the rule ==="
echo "Done. Patch AVideo upstream as soon as a fixed release is available, then re-test encoder callbacks."

Remediation

1. Patch immediately. Update WWBN AVideo to the latest release from the official WWBN/AVideo GitHub repository. Verify with the project which release contains the CVE-2026-86189 fix and confirm your deployment is at or above that version. Monitor the NVD entry and the CISA KEV catalog for updated references and any federal remediation deadlines.

2. If you cannot patch today, block the endpoint. The notify endpoint only needs to be reachable by the host running ffmpeg transcoding — typically localhost or a small set of internal encoder IPs. Apply the Nginx/Apache allow/deny rules from the script above. This is a highly effective compensating control because the vulnerability requires direct, unauthenticated network access to the endpoint.

3. Inventory your exposure. AVideo is frequently deployed as an embedded or white-labeled component in third-party streaming appliances and managed hosting. Enumerate not just known AVideo servers but any internet-facing PHP application that includes the AVideo codebase. Scan for the path /notify.ffmpeg.json.php across your external attack surface.

4. Hunt before you patch. Assume exploitation may have already occurred, especially on internet-facing instances that were exposed before disclosure. Run the KQL queries and VQL artifacts above. Review web logs going back at least 30 days for requests to the endpoint from unexpected source IPs. Inspect all PHP files modified in the webroot within the exposure window — diff against a clean release tarball.

5. If compromise is confirmed: isolate the host, acquire volatile data (running processes, network connections), preserve web and system logs, rotate all credentials stored in or accessible to the application (AVideo database credentials, API keys, stream keys), and rebuild from known-good media rather than attempting in-place cleanup. A webshell as www-data frequently escalates; treat the host as fully compromised.

6. Harden persistently. Run the web server under a least-privilege account with write access restricted to designated upload/cache directories only — never the application root. Deploy a WAF rule blocking requests containing traversal sequences to any .php endpoint. Enable file integrity monitoring on the webroot so future unauthorized writes alert in minutes, not months.

7. Validate your transcoding architecture. The callback endpoint exists so ffmpeg jobs can notify the application of completed encodes. If your transcoding runs on the same host, bind the endpoint to localhost only. If it runs on separate encoder nodes, restrict by source IP at both the web server and network firewall layers.

Bottom Line

CVE-2026-86189 combines the two flaws defenders dread most in a web application: an authentication check that authenticates nothing, and a file write that goes anywhere. The patch-and-block guidance above will close the hole, but the hunt matters just as much — a CVSS 9.8 unauthenticated file write on an internet-facing video platform will attract automated exploitation fast. Check your logs, check your webroot, and verify the fix.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub