Path Traversal in AVideo Plugin Allows Arbitrary File Writing

WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized response[lang] parameter. Attackers can send a type=translation request with a crafted lang value to plant attacker-controlled content in the webroot or overwrite other users' subtitle files.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

WWBN AVideo contains a critical path traversal vulnerability in its AI plugin that enables attackers with valid AI tokens to write arbitrary .vtt subtitle files to unintended locations. By injecting directory traversal sequences into the unsanitized response[lang] parameter, attackers can plant malicious content in the web root or overwrite legitimate subtitle files belonging to other users. This vulnerability affects any organization running vulnerable versions of AVideo with the AI plugin enabled, particularly those managing multi-user video platforms where subtitle integrity and content control are important security considerations.

Casky's 351 mapped security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK's Resource Development (TA0001) and Discovery (TA0007) phases. Practitioners using Casky would identify suspicious patterns such as token enumeration attempts to acquire valid AI credentials, reconnaissance of plugin endpoints to locate receiveAsync.json.php, and anomalous file write operations with traversal sequences like "../" in lang parameters. The platform's skills would surface indicators like unusual POST requests to translation endpoints with crafted payloads, unexpected .vtt file creation outside designated directories, and modifications to existing subtitle files without corresponding user actions—enabling security teams to detect exploitation attempts before malicious content reaches production systems.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-124424.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-124424

Casky has 351 skills that investigate the attack patterns behind CVE-2026-124424. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn