Loading vulnerability…
Arbitrary File Deletion via Path Traversal in WWBN AVideo CloneSite
CVE-2026-33293 is a path traversal vulnerability in WWBN AVideo, an open source video platform, affecting versions prior to 26.0. The flaw is in plugin/CloneSite/cloneServer.json.php, where the deleteDump parameter is passed directly to unlink() without path sanitization or restriction to an intended directory. An attacker with valid clone credentials can supply traversal sequences such as ../../ to escape the expected path and cause deletion of arbitrary files on the server. The issue can be used to remove critical application files, including configuration.php, resulting in service failure and potentially weakening application security controls.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker with valid clone credentials to delete arbitrary files accessible to the web application process. This can cause complete denial of service by removing essential application files, and can also create conditions for follow-on compromise by deleting security-relevant files or otherwise destabilizing the application environment. Based on the provided information, the primary impacts are high integrity loss and high availability loss; no direct confidentiality impact is stated.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, disable or restrict access to the CloneSite functionality and specifically plugin/CloneSite/cloneServer.json.php to only trusted administrative workflows. Rotate or revoke clone credentials that are not strictly necessary. Apply server-side validation to reject traversal sequences and enforce canonical-path checks before any file deletion operation. Limit filesystem permissions of the web application user so it cannot delete sensitive application or system files outside the minimum required directories. Monitor for suspicious requests containing traversal patterns such as ../ targeting CloneSite endpoints.
Patch, then assume compromise.
Upgrade WWBN AVideo to version 26.0 or later, which fixes the vulnerable handling of the deleteDump parameter. The fix should ensure the supplied path cannot traverse outside the intended directory and that file deletion is restricted to explicitly allowed files or locations. Review the referenced fix commit and security advisory, and verify that all deployed instances, including any customized forks, incorporate the patch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.