PT-2026-34227 · Avideo+1 · Clonesite+1

Published 2026-04-16 · Updated 2026-04-25 · CVE-2026-41304

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier

Description The CloneSite plugin contains a flaw where the 'cloneServer.json.php' endpoint constructs shell commands using the url parameter without proper sanitization. This input is directly concatenated into a wget command executed via the exec() function, enabling command injection. An attacker can use shell metacharacters to execute arbitrary shell commands, leading to Remote Code Execution (RCE), which is the ability to execute any command on the target machine remotely.

Recommendations Update to the version containing commit 473c609fc2defdea8b937b00e86ce88eba1f15bb. As a temporary workaround, restrict access to the 'cloneServer.json.php' endpoint or avoid using the url parameter in the CloneSite plugin until the update is applied.

Exploit

Fix

RCE

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-41304

GHSA-XR6F-H4X7-R6QP

Affected Products

Avideo

Clonesite

References · 9

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-xr6f-h4x7-r6qp · Exploit
• https://github.com/WWBN/AVideo/commit/473c609fc2defdea8b937b00e86ce88eba1f15bb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41304 · Security Note
• https://osv.dev/vulnerability/GHSA-xr6f-h4x7-r6qp · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/CVEnew/status/2048168408894832973 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046825317952618810 · Twitter Post
• https://twitter.com/infoflowcloud/status/2048169344299835826 · Twitter Post
• https://twitter.com/zench4n/status/2047862868906021258 · Twitter Post