CVE-2026-41058 Details
Description
WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter. Commit 3c729717c26f160014a5c86b0b6accdbd613e7b2 contains an updated fix.
A path traversal vulnerability has been identified in the WWBN AVideo platform, specifically in versions 29.0 and below. The issue arises in the CloneSite plugin's 'deleteDump' parameter, which fails to properly sanitize input before it is used to delete files. This oversight allows attackers to manipulate the parameter with '../' sequences to delete arbitrary files on the server via the 'unlink()' function. Exploitation of this vulnerability can lead to the deletion of critical application files, causing a denial-of-service condition or facilitating further attacks by removing essential security files.
Users are advised to update to AVideo version 29.0 or later, where this vulnerability has been addressed. The fix involves implementing proper path validation and sanitization for the 'deleteDump' parameter to prevent path traversal attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/WWBN/AVideo/commit/3c729717c26f160014a5c86b0b6accdbd613e7b2 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/commit/941decd6d19e2e694acb75e86317d10fbb560284 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2 | [email protected] | ExploitMitigationVendor Advisory |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-xmjm-86qv-g226 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 29.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |