CVE-2026-41304: WWBN AVideo RCE Vulnerability

CVE-2026-41304 Overview

CVE-2026-41304 is a command injection vulnerability in WWBN AVideo, an open source video platform. In versions 29.0 and below, the cloneServer.json.php endpoint in the CloneSite plugin constructs shell commands using user-controlled input (url parameter) without proper sanitization. The input is directly concatenated into a wget command executed via exec(), allowing command injection. An attacker can inject arbitrary shell commands by breaking out of the intended URL context using shell metacharacters (e.g., ;). This leads to Remote Code Execution (RCE) on the server.

Critical Impact

Unauthenticated remote attackers can execute arbitrary commands on vulnerable AVideo servers, potentially leading to complete system compromise, data theft, or service disruption.

Affected Products

• WWBN AVideo versions 29.0 and below
• AVideo CloneSite plugin with vulnerable cloneServer.json.php endpoint

Discovery Timeline

• April 22, 2026 - CVE-2026-41304 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41304

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Command Injection). The CloneSite plugin's cloneServer.json.php endpoint accepts a user-supplied url parameter that is intended to specify a remote server URL for the wget command. However, the application fails to properly sanitize or validate this input before incorporating it into a shell command that is executed via PHP's exec() function.

The fundamental security flaw is the direct concatenation of untrusted user input into a system command without escaping shell metacharacters. When the url parameter is processed, an attacker can terminate the intended wget command and append arbitrary shell commands using characters like semicolons (;), pipes (|), or command substitution syntax.

This vulnerability allows unauthenticated remote attackers to execute arbitrary commands with the privileges of the web server process. Successful exploitation could result in complete server compromise, unauthorized data access, installation of backdoors, lateral movement within the network, or use of the compromised server for further attacks.

Root Cause

The root cause of this vulnerability is insufficient input validation and the dangerous use of exec() with unsanitized user input. The cloneServer.json.php endpoint directly concatenates the user-supplied url parameter into a wget shell command without implementing proper escaping functions like escapeshellarg() or escapeshellcmd(), or employing a whitelist-based validation approach for URL inputs.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication. An attacker crafts a malicious HTTP request to the vulnerable cloneServer.json.php endpoint, including shell metacharacters in the url parameter. For example, by appending ; id or ; cat /etc/passwd to the URL parameter, an attacker can inject additional commands that will be executed by the server.

The attack requires no user interaction and can be executed directly against any exposed AVideo installation running a vulnerable version. The attacker simply needs to identify a vulnerable instance and submit a crafted request containing the malicious payload in the url parameter. For detailed technical information about the vulnerability mechanism and exploitation, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-41304

Indicators of Compromise

• Suspicious HTTP requests to /plugin/CloneSite/cloneServer.json.php containing shell metacharacters (;, |, $(), backticks) in the url parameter
• Unexpected child processes spawned by the web server process (e.g., Apache, nginx, PHP-FPM)
• Unusual outbound network connections from the web server
• Web server logs showing requests with encoded shell commands in URL parameters
• Newly created files in web-accessible directories or unexpected system modifications

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing shell metacharacters in the url parameter of cloneServer.json.php
• Monitor web server access logs for requests to the CloneSite plugin endpoint with suspicious URL patterns
• Deploy endpoint detection and response (EDR) solutions to identify command execution chains originating from web server processes
• Use intrusion detection systems (IDS) to alert on command injection patterns in HTTP traffic

Monitoring Recommendations

• Enable verbose logging for web server processes and PHP execution
• Configure alerts for unusual process execution hierarchies involving wget, curl, or shell interpreters spawned by web applications
• Monitor system calls and file system changes on servers hosting AVideo installations
• Review authentication and access logs for signs of post-exploitation activity

How to Mitigate CVE-2026-41304

Immediate Actions Required

• Update AVideo to a version containing commit 473c609fc2defdea8b937b00e86ce88eba1f15bb or later
• If immediate patching is not possible, disable or remove the CloneSite plugin until the update can be applied
• Review web server logs for any evidence of exploitation attempts against the vulnerable endpoint
• Implement network-level access controls to restrict access to administrative plugin endpoints

Patch Information

The vulnerability has been addressed in commit 473c609fc2defdea8b937b00e86ce88eba1f15bb. Administrators should update their AVideo installations to incorporate this fix. The patch can be reviewed in the GitHub Commit Update. Additional details are available in the GitHub Security Advisory.

Workarounds

• Disable the CloneSite plugin by removing or renaming the plugin/CloneSite directory until a patch can be applied
• Implement a web application firewall rule to block requests to cloneServer.json.php with any URL parameter containing shell metacharacters
• Restrict network access to the AVideo administrative interfaces to trusted IP addresses only
• Run the web server with minimal privileges and implement filesystem permissions to limit the impact of potential compromise

# Temporarily disable the CloneSite plugin
mv /var/www/avideo/plugin/CloneSite /var/www/avideo/plugin/CloneSite.disabled

# Restrict access to the plugin directory via Apache (add to .htaccess or vhost config)
<Directory "/var/www/avideo/plugin/CloneSite">
    Require all denied
</Directory>