CVE-2026-92580: AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF
In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (line ~270) the stored SSH password is substituted into the command string sshpass -p '{password}' rsync ... with a plain strreplace and no escaping, so a single quote in the password breaks out of the quoted word and injects arbitrary shell. The password is written through the admin-only endpoint objects/pluginAddDataObject.json.php, whose only CSRF defense (isUntrustedRequest()/forbidIfIsUntrustedRequest()) is a no-op when the request source appears to be loopback — as happens behind a same-host TLS-terminating reverse proxy with $global['trustedProxies'] unset — or when an attacker-controlled application is co-hosted on the same hostname; on HTTPS the session cookie is issued with SameSite=None, so a cross-site POST carries it. An unauthenticated remote attacker can therefore lure an authenticated administrator into planting a malicious password (and an attacker-controlled cloneSiteURL), after which the plugin's documented crontab entry executes the injected command with no further administrator action, as the crontab owner (commonly root or www-data). Exploitation requires the CloneSite plugin to be enabled with the documented crontab installed and one of the above CSRF channels; default single-process Apache deployments are reported as not CSRF-exploitable. This is a residual sink of CVE-2026-41304. The issue is confirmed at master HEAD (8963b6a1); no patched version is available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the CloneSite stored OS command injection by ensuring the SSH password is properly escaped/quoted when building the command line in plugin/CloneSite/cloneClient.json.php (line ~270), replacing the unsafe plain str_replace into `sshpass -p '{password}' rsync ...`.
AVideo (plugin/CloneSite/cloneClient.json.php) Shell quoting/escaping for sshpass password injection = Escape/quote the stored SSH password before substituting into `sshpass -p '{password}' rsync ...` (avoid plain str_replace into single-quoted shell argument) - Compensating control
Mitigate the CloneSite plugin CSRF-to-command-injection path by preventing untrusted cross-site requests from reaching the admin-only endpoint objects/pluginAddDataObject.json.php (the request CSRF defense is a no-op when isUntrustedRequest() indicates a loopback source or when $global['trustedProxies'] is unset behind a reverse proxy). Ensure trusted proxy settings are correctly configured and that admin-only endpoints reject requests that originate from untrusted sources.
Event History
Frequently Asked Questions
Which deployments are most exposed to the CSRF bypass?
Deployments behind a TLS-terminating reverse proxy running on the same host are exposed when $global['trustedProxies'] is unset, because requests can appear to originate from loopback. A co-hosted attacker-controlled application on the same hostname can also satisfy the described request-source condition.
What access or interaction does an attacker need?
The attacker does not need authentication, but must lure an authenticated AVideo administrator into submitting the malicious cross-site request. The attack relies on the administrator's HTTPS session cookie being sent with the request and plants both a crafted SSH password and an attacker-controlled cloneSiteURL.
When does the injected command run, and under which account?
Execution occurs when the CloneSite plugin's documented crontab entry runs; no further administrator action is required after the malicious settings are stored. The command runs as the crontab owner, which is commonly root or www-data.