Which versions of AVideo are affected by CVE-2026-41304?

AVideo versions 29.0 and below contain an unauthenticated remote code execution vulnerability in the CloneSite plugin that allows attackers to execute arbitrary commands on affected servers without…

AVideo CVE-2026-41304

Q: What is the CVSS score of CVE-2026-41304?

CVE-2026-41304 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.3%.

Q: How to fix or mitigate CVE-2026-41304?

Within 24 hours: Disable or restrict network access to the CloneSite plugin's cloneServer.json.php endpoint until patching is complete; audit access logs for exploitation attempts. Within 7 days: Upgrade AVideo to version 30.0 or later, or apply fix from commit 473c609fc2defdea8b937b00e86ce88eba1f15bb if available in your release branch. Within 30 days: Conduct forensic review of affected systems for indicators of compromise; validate all administrative credentials; implement web application firewall rules to block requests to cloneServer.json.php.

HIGH

Command Injection (CWE-77)

2026-04-21 GitHub_M

GHSA-xr6f-h4x7-r6qp

PHP Command Injection RCE

8.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 19:22 vuln.today

cvss_changed

Analysis Generated

Apr 22, 2026 - 00:57 vuln.today

CVSS changed

Apr 22, 2026 - 00:22 NVD

8.9 (HIGH)

Analysis Generated

Apr 21, 2026 - 23:31 vuln.today

CVE Published

Apr 21, 2026 - 23:07 nvd

HIGH 8.9

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and below, the cloneServer.json.php endpoint in the CloneSite plugin constructs shell commands using user-controlled input (url parameter) without proper sanitization. The input is directly concatenated into a wget command executed via exec(), allowing command injection. An attacker can inject arbitrary shell commands by breaking out of the intended URL context using shell metacharacters (e.g., ;). This leads to Remote Code Execution (RCE) on the server. Commit 473c609fc2defdea8b937b00e86ce88eba1f15bb contains a fix.

AnalysisAI

Remote code execution in AVideo versions 29.0 and below allows unauthenticated attackers to execute arbitrary shell commands on the server via command injection in the CloneSite plugin's cloneServer.json.php endpoint. Attackers exploit unsanitized user input in the 'url' parameter that gets directly concatenated into a wget command executed through PHP's exec() function. With CVSS 8.9 (AV:N/AC:L/PR:N/UI:N) and proof-of-concept exploitation confirmed (E:P), this represents a critical risk requiring immediate patching. Fix available in commit 473c609fc2defdea8b937b00e86ce88eba1f15bb.

Technical ContextAI

AVideo is an open-source video platform built in PHP. The vulnerability (CWE-77: Improper Neutralization of Special Elements used in a Command) exists in the CloneSite plugin's cloneServer.json.php file, which constructs shell commands by directly concatenating user-supplied input into system commands. The code pattern vulnerable to this flaw uses PHP's exec() function to execute wget with an attacker-controlled URL parameter. Shell metacharacters like semicolons (;), pipes (|), backticks (`), or command substitution operators allow breaking out of the intended command context to inject arbitrary commands. This architectural weakness-executing system commands with unsanitized web input-represents a fundamental security anti-pattern in web application development. The CPE identifier cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* indicates all versions through 29.0 are affected.

RemediationAI

Apply the vendor-released patch immediately by upgrading to AVideo commit 473c609fc2defdea8b937b00e86ce88eba1f15bb or later from the official repository (https://github.com/WWBN/AVideo/commit/473c609fc2defdea8b937b00e86ce88eba1f15bb). The commit implements proper input sanitization for the url parameter in cloneServer.json.php. For organizations unable to patch immediately, disable the CloneSite plugin entirely through the AVideo administration interface-this removes the vulnerable endpoint but eliminates server cloning functionality. Alternatively, implement web application firewall (WAF) rules to block requests to /plugin/CloneSite/cloneServer.json.php, though this may break legitimate cloning operations and should not replace patching. Network-level mitigation: restrict access to the AVideo admin interface to trusted IP ranges using firewall rules or reverse proxy ACLs, reducing attack surface but not eliminating risk from authenticated or internal attackers. Review server logs for requests to cloneServer.json.php containing shell metacharacters (;|&`$()) as indicators of exploitation attempts. Consult the GitHub advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-xr6f-h4x7-r6qp for additional vendor guidance.