CVE Intelligence
Analysis AI-assisted

CVE-2026-41304: WWBN AVideo command injection (RCE) in CloneSite plugin

WWBN AVideo versions 29.0 and below are affected by a command injection flaw in the cloneServer.json.php endpoint of the CloneSite plugin, where the url parameter is concatenated into a wget command run via exec(). The record describes this as enabling remote code execution, with an NVD base score of 9.8 (critical). A fix commit is referenced, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

WWBN AVideo is an open source video platform. According to the GitHub Security Advisory, the cloneServer.json.php endpoint of the CloneSite plugin builds a shell command from the url parameter without adequate sanitization, and that value is passed into a wget command executed through exec(). The record classifies the weakness as CWE-77 (Command Injection).

Impact

  • The sources describe the result as remote code execution on the server.
  • The NVD base score is 9.8 (critical). The GitHub CNA score is 8.9.
  • The NVD assessment rates confidentiality, integrity and availability impact as high.

Affected products and versions

  • Wwbn Avideo: versions 29.0 and below, as listed in the record.
  • The record provides no further product or version detail.

Exploitation status

  • The CVE is not listed in CISA KEV in the record, so no confirmed active exploitation is stated.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The SSVC data in the record lists exploitation as poc, and the EPSS probability is 0.02693 with a percentile of 0.85796.

Remediation and mitigation

  • Apply the patch from commit 473c609fc2defdea8b937b00e86ce88eba1f15bb, as referenced by the record.
  • Review the GitHub Security Advisory for the mitigation guidance it provides: GHSA-xr6f-h4x7-r6qp.
  • If the CloneSite plugin is not needed, consider disabling it until the update is applied.

Detection guidance

  • Review web server logs for unusual values in requests to cloneServer.json.php.
  • Look for unexpected child processes started by the web server account, or unexpected outbound connections from the web server.
  • Check whether the CloneSite plugin is installed and enabled on internet-facing instances.

Limitations of the available information

  • The record does not state a fixed release number, only a fix commit.
  • The record does not state whether the CloneSite plugin is enabled by default.
  • The EPSS date in the record (2026-10-23) is later than the publication date and should be verified against the source.
  • The record does not include a timeline of vendor disclosure or patch release.

Frequently asked questions

Which WWBN AVideo versions are affected by CVE-2026-41304?

The record states versions 29.0 and below are affected. It does not list any later fixed release number, only a fix commit.

Is CVE-2026-41304 being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. SSVC data in the record shows a poc exploitation status.

What should administrators do first?

Apply the fix from the referenced commit, follow the GitHub advisory mitigation guidance, and consider disabling the CloneSite plugin if it is not needed until the update is in place.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.