CVE-2026-41304: WWBN AVideo vulnerable to RCE caused by clonesite plugin
WWBN AVideo is an open source video platform. In versions 29.0 and below, the cloneServer.json.php endpoint in the CloneSite plugin constructs shell commands using user-controlled input (url parameter) without proper sanitization. The input is directly concatenated into a wget command executed via exec(), allowing command injection. An attacker can inject arbitrary shell commands by breaking out of the intended URL context using shell metacharacters (e.g., ;). This leads to Remote Code Execution (RCE) on the server. Commit 473c609fc2defdea8b937b00e86ce88eba1f15bb contains a fix.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41304?
CVE-2026-41304 has a critical severity due to the potential for remote code execution.
How do I fix CVE-2026-41304?
To fix CVE-2026-41304, update your WWBN AVideo installation to version 29.1 or later.
What causes CVE-2026-41304?
CVE-2026-41304 is caused by the CloneSite plugin improperly handling user-controlled input in the `cloneServer.json.php` endpoint.
Which versions of WWBN AVideo are affected by CVE-2026-41304?
CVE-2026-41304 affects all versions of WWBN AVideo up to and including 29.0.
Can CVE-2026-41304 be exploited without authentication?
Yes, CVE-2026-41304 can be exploited remotely without authentication, making it particularly dangerous.