CVE-2026-41058 | THREATINT

Description

WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter. Commit 3c729717c26f160014a5c86b0b6accdbd613e7b2 contains an updated fix.

PUBLISHED Reserved 2026-04-16 | Published 2026-04-21 | Updated 2026-04-22 | Assigner GitHub_M

HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

<= 29.0

affected

References

github.com/...AVideo/security/advisories/GHSA-5879-4fmr-xwf2 exploit

github.com/...AVideo/security/advisories/GHSA-5879-4fmr-xwf2

github.com/...AVideo/security/advisories/GHSA-xmjm-86qv-g226

github.com/...ommit/3c729717c26f160014a5c86b0b6accdbd613e7b2

github.com/...ommit/941decd6d19e2e694acb75e86317d10fbb560284

cve.org (CVE-2026-41058)

nvd.nist.gov (CVE-2026-41058)

Download JSON