CVE-2026-84478

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-84478
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84478.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-84478
Aliases
  • GHSA-wh69-gqmj-rcqg
Published
2026-09-01T22:25:32.489Z
Modified
2026-09-03T03:30:59.622386604Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
WWBN AVideo Unauthenticated Arbitrary Log File Deletion
Details

WWBN AVideo contains a path traversal vulnerability in the API getapilogin_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84478.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-73"
    ]
}
References

Affected packages

Git / github.com/wwbn/avideo

Affected ranges

Type
GIT
Repo
https://github.com/wwbn/avideo
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2386f39caea1d2ef36267b252fa76af283294623
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "29.0"
        }
    ]
}

Affected versions

10.*
10.8
Other
11
11.*
11.1
11.1.1
11.5
11.6
12.*
12.4
14.*
14.3
14.3.1
18.*
18.0
2.*
2.2
2.7
21.*
21.0
22.*
22.0
24.*
24.0
25.*
25.0
26.*
26.0
29.*
29.0
3.*
3.4
4.*
4.0
7.*
7.2
7.3
7.4
7.6
7.7
7.8
8.*
8.1
8.5
8.6
8.7
8.9
8.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84478.json"