Command Injection Vulnerability in WWBN AVideo CloneSite Plugin
CVE-2026-41304

8.9HIGH

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
21 April 2026

What is CVE-2026-41304?

The CloneSite plugin in WWBN AVideo, an open source video platform, is prone to a command injection vulnerability due to insufficient sanitization of user-controlled input in the cloneServer.json.php endpoint. Attackers can manipulate the url parameter to inject arbitrary shell commands, potentially leading to Remote Code Execution (RCE) on the server. This security flaw affects versions 29.0 and earlier, and a fix has been implemented in commit 473c609fc2defdea8b937b00e86ce88eba1f15bb.

Affected Version(s)

AVideo <= 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-x...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/473c609fc2defdea8b9...
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.