WWBN AVideo up to 25.x cloneServer.json.php unlink deleteDump path traversal

Summaryinfo

A vulnerability was found in WWBN AVideo up to 25.x and classified as critical. The affected element is the function unlink of the file plugin/CloneSite/cloneServer.json.php. Executing a manipulation of the argument deleteDump can lead to path traversal. This vulnerability appears as CVE-2026-33293. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in WWBN AVideo up to 25.x. This vulnerability affects the function unlink of the file plugin/CloneSite/cloneServer.json.php. The manipulation of the argument deleteDump with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect integrity, and availability. CVE summarizes:

WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly to `unlink()` without any path sanitization. An attacker with valid clone credentials can use path traversal sequences (e.g., `../../`) to delete arbitrary files on the server, including critical application files such as `configuration.php`, causing complete denial of service or enabling further attacks by removing security-critical files. Version 26.0 fixes the issue.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-33293 since 03/18/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

By approaching the search of inurl:plugin/CloneSite/cloneServer.json.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 26.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 25.x

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion