Loading vulnerability…
Unauthenticated RCE chain in WWBN AVideo CloneSite plugin
CVE-2026-33478 affects WWBN AVideo, an open source video platform, in versions up to and including 26.0. The issue is a chained exploitation path in the CloneSite plugin. First, the clones.json.php endpoint exposes clone secret keys without authentication. Those keys can then be used with cloneServer.json.php to trigger a full database dump. The dump includes administrator password hashes stored as MD5, which are described as trivially crackable, enabling an attacker to recover admin credentials. After obtaining administrative access, the attacker can exploit an OS command injection flaw in cloneClient.json.php, specifically in the construction of an rsync command, to execute arbitrary system commands on the server. The supporting content also maps the issue to improper access control in addition to OS command injection.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a completely unauthenticated remote attacker to progress from information disclosure and unauthorized database access to administrative compromise and ultimately arbitrary command execution on the underlying host. This can result in full compromise of the AVideo instance and likely the supporting server environment, including theft of sensitive data, modification or destruction of application content and configuration, service disruption, and use of the host for further post-exploitation activity.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable or restrict access to the CloneSite plugin and its related endpoints, especially clones.json.php, cloneServer.json.php, and cloneClient.json.php. Limit access to trusted administrators only, place the application behind network access controls where feasible, and monitor for requests to these endpoints and for unexpected rsync or shell execution activity. Treat existing administrator credentials as potentially compromised due to MD5 hash exposure and rotate them. Review the host for indicators of command execution and unauthorized database export.
Patch, then assume compromise.
Upgrade to a version containing the fix for CVE-2026-33478. The provided content identifies commit c85d076375fab095a14170df7ddb27058134d38c as containing the patch. Remediation should include correcting the unauthenticated exposure of clone secret keys in clones.json.php, preventing unauthorized database dump access via cloneServer.json.php, and fixing the OS command injection in cloneClient.json.php by eliminating unsafe shell command construction for rsync. Because administrator password hashes may have been exposed, rotate all administrator credentials and any other secrets stored in or derived from the dumped database.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.