PT-2026-34204 · Wwbn · Avideo

Published 2026-04-14 · Updated 2026-04-25 · CVE-2026-41058

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier

Description An incomplete fix in the CloneSite feature allows for the deletion of arbitrary files. The deleteDump parameter in a GET request does not properly filter path traversal sequences, such as ../../, which enables the unlink() function to remove files outside of the intended directory.

Recommendations Update to the version containing commit 3c729717c26f160014a5c86b0b6accdbd613e7b2.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41058

GHSA-5879-4FMR-XWF2

Affected Products

Avideo

References · 11

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2 · Exploit
• https://github.com/WWBN/AVideo/commit/3c729717c26f160014a5c86b0b6accdbd613e7b2 · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-xmjm-86qv-g226 · Vendor Advisory
• https://github.com/WWBN/AVideo/commit/941decd6d19e2e694acb75e86317d10fbb560284 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33293 · Security Note
• https://osv.dev/vulnerability/GHSA-5879-4fmr-xwf2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41058 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/VulmonFeeds/status/2046873951981228347 · Twitter Post
• https://twitter.com/CVEnew/status/2048168414481661990 · Twitter Post
• https://twitter.com/infoflowcloud/status/2048169411270283437 · Twitter Post