PT-2026-26471 · Clonesite+1 · Clonesite+1

Restriction · Published 2026-03-19 · Updated 2026-04-14 · CVE-2026-33293

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 26.0

Description AVideo, an open source video platform, has a path traversal issue in the plugin/CloneSite/cloneServer.json.php file. The deleteDump parameter is passed directly to the unlink() function without proper path sanitization. An attacker with valid clone credentials can exploit this by using path traversal sequences (like ../../) within the deleteDump parameter to delete arbitrary files on the server. This includes critical application files such as configuration.php, potentially leading to complete denial of service or enabling further attacks by removing security-critical files. The vulnerable code is located at lines 10-11 and 44-46 of the plugin/CloneSite/cloneServer.json.php file, where the $clonesDir variable is set and used in conjunction with the unsanitized $ GET['deleteDump'] parameter. The deleteDump parameter is intended for deleting SQL dump files generated during the clone process, but the lack of validation allows attackers to bypass this intended functionality. The authentication guard thisURLCanCloneMe() requires valid clone credentials, which are held by approved clone partners.

Recommendations Versions prior to 26.0 should be updated to version 26.0 or later. Apply basename() to the deleteDump parameter to strip any directory traversal components, ensuring the deletion is restricted to files within $clonesDir. Additionally, implement a realpath() check to verify that the resolved path remains within the intended directory.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-33293

GHSA-5879-4FMR-XWF2

GHSA-XMJM-86QV-G226

Affected Products

Avideo

Clonesite

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33293.json · Exploit
• https://github.com/WWBN/AVideo/security/advisories/GHSA-xmjm-86qv-g226 · Vendor Advisory
• https://github.com/WWBN/AVideo/commit/941decd6d19e2e694acb75e86317d10fbb560284 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33293 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33293 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xmjm-86qv-g226 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5879-4fmr-xwf2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41058 · Security Note
• https://github.com/WWBN/AVideo/commit/3c729717c26f160014a5c86b0b6accdbd613e7b2 · Note
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2 · Note
• https://twitter.com/CVEnew/status/2035992501715140758 · Twitter Post
• https://twitter.com/TheHackerWire/status/2035809620690981358 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2035791586454319474 · Twitter Post