AVideo CloneSite Flaws Enable File Deletion and Unauthenticated RCE

WWBN AVideo was found to contain multiple high-severity flaws in its CloneSite plugin that can be abused for destructive attacks and full server compromise. One issue, tracked as CVE-2026-33293, affects versions prior to 26.0 and allows arbitrary file deletion through path traversal in the deleteDump parameter of plugin/CloneSite/cloneServer.json.php. Because the value was passed directly to unlink() without sanitization, an attacker with valid clone credentials could use ../../ sequences to remove arbitrary files such as configuration.php, causing denial of service and potentially weakening other protections.

A second issue, CVE-2026-33478, describes a broader attack chain in AVideo versions up to and including 26.0 that can lead to unauthenticated remote code execution. The clones.json.php endpoint exposed clone secret keys without authentication, which could then be used to trigger a full database dump via cloneServer.json.php; the dump reportedly included admin password hashes stored as MD5, enabling attackers to recover credentials and gain administrative access. From there, an OS command injection flaw in cloneClient.json.php involving rsync command construction could be used to execute arbitrary system commands. The vulnerabilities were mapped to CWE-22, CWE-78, and CWE-284, and fixes were released by WWBN, including a patch referenced in commit c85d076375fab095a14170df7ddb27058134d38c.