What is CVE-2026-72748?
AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint, allowing remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests. This can lead to disk space exhaustion and Denial of Service (DoS). Affected systems should immediately implement access control and restrict the endpoint.
Azərbaycanca: AVideo platformunda aVideoEncoderChunk.json.php vasitəsilə autentifikasiya olmadan server fayl sisteminə 4 GB-a qədər ixtiyari məzmun yazmağa imkan verən boşluqdur. Bu, disk sahəsini dolduraraq Denial of Service (DoS) vəziyyətinə səbəb ola bilər. Təsirlənən sistemlərdə dərhal giriş nəzarəti tətbiq edilməli və endpoint məhdudlaşdırılmalıdır.
FAQ2
What can an attacker achieve by exploiting CVE-2026-72748 in AVideo?
An attacker can write up to 4 GB of arbitrary content to the server filesystem without authentication via the aVideoEncoderChunk.json.php endpoint. This can exhaust disk space and lead to a Denial of Service (DoS).
What mitigation measures are recommended for CVE-2026-72748?
Affected systems should immediately implement access control and restrict the aVideoEncoderChunk.json.php endpoint.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.