WWBN AVideo
CVE-2026-41058
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to AVideo CloneSite endpoint
-
DeliverySend GET with deleteDump=../../ payload
-
ExploitBypass incomplete path filter
-
Executionunlink() arbitrary file
-
PersistDelete configuration.php/.htaccess
-
ImpactApplication integrity loss / DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the CloneSite plugin to be present and its |
| Impact | The signals point to a real but bounded issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:N/I:H/A:H, score 8.1) indicates network-reachable, low-complexity exploitation requiring some privilege, with high integrity and availability impact but no confidentiality loss - consistent with arbitrary file deletion rather than data theft or code execution. SSVC aligns: Exploitation=poc (not active), Automatable=no, Technical Impact=partial. EPSS is very low at 0.04% (14th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of widespread or active exploitation. The main tension is between the high 8.1 base score and the low EPSS/poc-only status: the score is driven by I:H/A:H, but real-world weaponization is constrained by the PR:L requirement (attacker needs authenticated/privileged access to the CloneSite endpoint) and the fact that CloneSite is an optional admin plugin, not a default-exposed surface. Net: prioritize patching where AVideo with CloneSite is deployed, but this is not a mass-exploitation, drop-everything threat. |
| Exploit ScenarioDerived | An attacker with authenticated access to an AVideo instance running the CloneSite plugin sends a crafted GET request to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Arbitrary file deletion in WWBN AVideo (versions 29.0 and below) lets an authenticated attacker abuse the CloneSite plugin's deleteDump GET parameter to unlink() any file the web server can access. The deleteDump value is concatenated directly onto the clones directory path with no sanitization, so ../../ sequences escape the intended directory. This is an incomplete-fix regression of CVE-2026-33293; publicly available exploit code exists (advisory PoC), but there is no public exploit identified as used in active attacks, and EPSS risk is very low (0.04%).
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - no tagged release is cited, so update to a build that includes commit 941decd6d19e2e694acb75e86317d10fbb560284 (and follow-up 3c729717c26f160014a5c86b0b6accdbd613e7b2), which enforces directory containment by appending a trailing separator to the clones-directory prefix before the strpos check. Review the GHSA advisories at https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2 and https://github.com/WWBN/AVideo/security/advisories/GHSA-xmjm-86qv-g226 for guidance. If you cannot patch immediately, disable the CloneSite plugin entirely (it is an optional site-cloning feature, so disabling it removes the vulnerable cloneServer.json.php endpoint at the cost of losing clone/backup functionality); alternatively, block or restrict web access to plugin/CloneSite/cloneServer.json.php at the reverse proxy/web-server layer and tighten administrative authentication, accepting that this breaks legitimate CloneSite operations. Because the advisory also notes exec() calls passing mysqldump credentials on the command line, restrict shell/process visibility on the host as a defense-in-depth measure.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AVideo is a PHP-based open-source video streaming/CMS platform (vendor WWBN, CPE cpe:2.3:a:wwbn:avideo). The flaw lives in the CloneSite plugin's plugin/CloneSite/cloneServer.json.php, which builds a deletion target as "{$clonesDir}{$_GET['deleteDump']}" and passes it straight to unlink(). Per the GHSA advisory the pre-fix code has no basename() to strip directory components, no realpath() canonicalization, no ../ stripping, and no containment check that the resolved path stays inside $clonesDir. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal). The root cause of THIS CVE is that the earlier CVE-2026-33293 fix was incomplete: the containment check used strpos($realFilePath, $realClonesDir) !== 0, which a sibling-directory prefix could satisfy; the corrected commit appends a trailing directory separator ($realClonesDirPrefix = rtrim($realClonesDir, '/\\') . DIRECTORY_SEPARATOR) before the prefix comparison to enforce true directory containment.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable endpoint (AV:N), simple traversal payload (AC:L), requires authenticated access to CloneSite (PR:L); arbitrary file deletion gives I:H/A:H but no data disclosure (C:N).
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite deleteDump parameter does not apply path traversal filtering, allowing unlink() of arbitrary files via ../../ sequences in the GET parameter. Commit 3c729717c26f160014a5c86b0b6accdbd613e7b2 contains an updated fix.
Executive ViewAI
WWBN AVideo versions 29.0 and below contain a vulnerability enabling authenticated users to delete arbitrary files on affected servers, creating significant risk of data loss and service disruption. This threat is amplified by insider risk and compromised user accounts with system access. Organizations running vulnerable versions must act immediately to mitigate risk pending availability of a vendor patch.
Disable the CloneSite plugin if not mission-critical. If the plugin must remain enabled, implement strict file system permissions restricting the web server process to read-only access outside its required working directories. Segment AVideo instances to internal networks only, restricting access behind centralized authentication. Enforce multi-factor authentication on all administrative accounts. Deploy file integrity monitoring on data directories and configure alerts for unauthorized file deletions. Audit and restrict AVideo administrative users to minimum necessary; review authentication logs weekly for suspicious patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)CVE.org
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB