What is the CVSS score of CVE-2026-41058?

CVE-2026-41058 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WWBN AVideo are affected by CVE-2026-41058?

WWBN AVideo versions 29.0 and below contain a vulnerability enabling authenticated users to delete arbitrary files on affected servers, creating significant risk of data loss and service disruption.

How to fix or mitigate CVE-2026-41058?

Within 24 hours, inventory all systems running WWBN AVideo version 29.0 or below and document which are internet-accessible, noting that publicly available exploit code exists; audit administrative user accounts for necessity and recent activity. Within 7 days, disable the CloneSite plugin if operationally feasible, implement multi-factor authentication on all administrative accounts, and restrict administrative access and web traffic to internal networks only. Within 30 days, enforce strict file system permissions restricting the AVideo process to read-only access outside required directories, deploy file integrity monitoring on critical data directories to alert on unauthorized deletions, and monitor WWBN security announcements to deploy a patch within 48 hours of vendor release.

WWBN AVideo CVE-2026-41058

HIGH

Path Traversal (CWE-22)

2026-04-21 security-advisories@github.com

Path Traversal Avideo

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable endpoint (AV:N), simple traversal payload (AC:L), requires authenticated access to CloneSite (PR:L); arbitrary file deletion gives I:H/A:H but no data disclosure (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 05:25 vuln.today

Analysis Generated

Jul 24, 2026 - 05:25 vuln.today

CVE Published

Apr 21, 2026 - 23:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite deleteDump parameter does not apply path traversal filtering, allowing unlink() of arbitrary files via ../../ sequences in the GET parameter. Commit 3c729717c26f160014a5c86b0b6accdbd613e7b2 contains an updated fix.

AnalysisAI

Arbitrary file deletion in WWBN AVideo (versions 29.0 and below) lets an authenticated attacker abuse the CloneSite plugin's deleteDump GET parameter to unlink() any file the web server can access. The deleteDump value is concatenated directly onto the clones directory path with no sanitization, so ../../ sequences escape the intended directory. This is an incomplete-fix regression of CVE-2026-33293; publicly available exploit code exists (advisory PoC), but there is no public exploit identified as used in active attacks, and EPSS risk is very low (0.04%).

Technical ContextAI

AVideo is a PHP-based open-source video streaming/CMS platform (vendor WWBN, CPE cpe:2.3:a:wwbn:avideo). The flaw lives in the CloneSite plugin's plugin/CloneSite/cloneServer.json.php, which builds a deletion target as "{$clonesDir}{$_GET['deleteDump']}" and passes it straight to unlink(). Per the GHSA advisory the pre-fix code has no basename() to strip directory components, no realpath() canonicalization, no ../ stripping, and no containment check that the resolved path stays inside $clonesDir. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal). The root cause of THIS CVE is that the earlier CVE-2026-33293 fix was incomplete: the containment check used strpos($realFilePath, $realClonesDir) !== 0, which a sibling-directory prefix could satisfy; the corrected commit appends a trailing directory separator ($realClonesDirPrefix = rtrim($realClonesDir, '/\\') . DIRECTORY_SEPARATOR) before the prefix comparison to enforce true directory containment.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - no tagged release is cited, so update to a build that includes commit 941decd6d19e2e694acb75e86317d10fbb560284 (and follow-up 3c729717c26f160014a5c86b0b6accdbd613e7b2), which enforces directory containment by appending a trailing separator to the clones-directory prefix before the strpos check. Review the GHSA advisories at https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2 and https://github.com/WWBN/AVideo/security/advisories/GHSA-xmjm-86qv-g226 for guidance. If you cannot patch immediately, disable the CloneSite plugin entirely (it is an optional site-cloning feature, so disabling it removes the vulnerable cloneServer.json.php endpoint at the cost of losing clone/backup functionality); alternatively, block or restrict web access to plugin/CloneSite/cloneServer.json.php at the reverse proxy/web-server layer and tighten administrative authentication, accepting that this breaks legitimate CloneSite operations. Because the advisory also notes exec() calls passing mysqldump credentials on the command line, restrict shell/process visibility on the host as a defense-in-depth measure.