AVideo AI plugin path traversal lets any valid-AI-token holder write arbitrary .vtt files (CVE-2026-124424)

CVE-2026-124424 (CVSS 7.1, CWE-22) — path traversal in WWBN/AVideo plugin/AI/receiveAsync.json.php. The endpoint sets bypassSameDomainCheck and performs no session/ownership validation; in the type=translation branch the user-controlled response[lang] is passed unsanitized into getVTTPaths(), so a traversal payload in lang writes attacker-controlled content to any *.vtt path the web server user can write, including other users' subtitle files and the webroot. Not directly RCE (the .vtt suffix is forced and not executed), but full integrity control over the subtitled-content surface plus DoS via overwrite.

An AI-component path traversal granting arbitrary file-write with only a low-privilege, non-expiring AI token — an integrity/content-planting exposure over the AI subtitle surface. It is niche in reach, but the unbound, expiring-never token model amplifies the exposure (any prior/leaked token remains usable), which is why it is worth cataloguing.

A translation request to plugin/AI/receiveAsync.json.php with a valid AI token and a crafted response[lang] containing traversal sequences. lang is passed unsanitized into Ai_transcribe_responses::getVTTPaths(), so attacker-controlled content is written to any *.vtt path the web server user can write — including webroot planting (served over HTTP) and out-of-tree writes — with no session or ownership check and bypassSameDomainCheck set.

WWBN/AVideo master (plugin/AI/receiveAsync.json.php), AI plugin enabled

Validate lang against a whitelist (e.g. /^[a-z0-9_-]{2,8}$/i) before getVTTPaths(), or make getVTTPaths reject any lang containing /, \, .. or NUL; enforce AI-token expiry and bind tokens to the requester and video owner. See advisory GHSA-v64v-r7qm-w5x4.