RCE in Wwbn Avideo

CVE-2026-41304

WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands using user-controlled input (`url` parameter) without proper sanitization. The…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.006 (71.2th percentile) — read the EPSS interpretation.

Affected products

Wwbn Avideo — versions <= 29.0

Weakness classification (CWE)

CWE-77 — Command Injection

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-xr6f-h4x7-r6qp (x_refsource_CONFIRM)
https://github.com/WWBN/AVideo/commit/473c609fc2defdea8b937b00e86ce88eba1f15bb (x_refsource_MISC)