AVideo Path Traversal Vulnerability

AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations.

Attackers can replay previously issued ciphertext as a notifyCode token to bypass authentication and write files to the application root and subdirectories.