CVE-2026-33478 Details

A remote code execution vulnerability has been identified in WWBN AVideo versions through 26.0, specifically within the CloneSite plugin. This vulnerability allows an unauthenticated attacker to execute arbitrary commands on the server. The issue arises from the `clones.json.php` endpoint, which exposes clone secret keys without authentication. These keys can be used to initiate a database dump via `cloneServer.json.php`. The dumped database contains admin password hashes stored as MD5, which are easily crackable. Once an attacker gains admin access, they can exploit an OS command injection vulnerability in the `rsync` command construction within `cloneClient.json.php` to execute arbitrary system commands.

Users are advised to update to the patched version of AVideo, which includes authentication for the `clones.json.php` endpoint, prevents SQL dumps from being stored in web-accessible directories, upgrades password hashing to a more secure method, and sanitizes parameters in the `rsync` command to prevent injection attacks.