CVE-2026-33293
published 2026-03-22CVE-2026-33293: WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly…
PriorityP352high8.1CVSS 3.1
AVNACLPRLUINSUCNIHAH
EPSS
0.51%
39.3th percentile
WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly to `unlink()` without any path sanitization. An attacker with valid clone credentials can use path traversal sequences (e.g., `../../`) to delete arbitrary files on the server, including critical application files such as `configuration.php`, causing complete denial of service or enabling further attacks by removing security-critical files. Version 26.0 fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | < 26.0 | 26.0 |
| wwbn | avideo | <= 29.0 | — |
| wwbn | avideo | 0 – 29.0 | — |
| wwbn | avideo | 0 – 25.0 | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
ghsa8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal
ghsa·2026-04-14·CVSS 8.1
CVE-2026-33293 [HIGH] CWE-22 WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal
### Summary
The incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter.
### Affected Package
- **Ecosystem:** Other
- **Package:** AVideo
- **Affected versions:** = commit 941decd6d19e
### Details
At line 44-48 of `cloneServer.json.php` (pre-fix):
```php
if (!empty($_GET['deleteDump'])) {
$resp->error = !unlink("{$clonesDir}{$_GET['deleteDump']}");
$resp->msg = "Delete Dump {$_GET['deleteDump']}";
die(json_encode($resp));
}
```
No `basename()`, no `realpath()` check, no path traversal filtering. `$_GET['deleteDump']` is concatenated directly with `$clonesDir`.
The vulnerable code has ze
OSV
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
osv·2026-03-19
CVE-2026-33293 [HIGH] AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
## Summary
The `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly to `unlink()` without any path sanitization. An attacker with valid clone credentials can use path traversal sequences (e.g., `../../`) to delete arbitrary files on the server, including critical application files such as `configuration.php`, causing complete denial of service or enabling further attacks by removing security-critical files.
## Details
In `plugin/CloneSite/cloneServer.json.php`, the `$clonesDir` variable is set to the application's storage path appended with `clones/` (line 11). When a `deleteDump` GET parameter is provided, its value is concatenated directly into a path passed
GHSA
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
ghsa·2026-03-19
CVE-2026-33293 [HIGH] CWE-22 AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
## Summary
The `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly to `unlink()` without any path sanitization. An attacker with valid clone credentials can use path traversal sequences (e.g., `../../`) to delete arbitrary files on the server, including critical application files such as `configuration.php`, causing complete denial of service or enabling further attacks by removing security-critical files.
## Details
In `plugin/CloneSite/cloneServer.json.php`, the `$clonesDir` variable is set to the application's storage path appended with `clones/` (line 11). When a `deleteDump` GET parameter is provided, its value is concatenated directly into a path passed
No detection rules found.
No public exploits indexed.
2026-03-22
Published