CVE-2026-92580: AVideo CloneSite Plugin RCE Vulnerability

CVE-2026-92580 Overview

CVE-2026-92580 is a stored operating system command injection vulnerability in the AVideo CloneSite plugin through version 29.0. The flaw exists in plugin/CloneSite/cloneClient.json.php where a stored SSH password is substituted into an sshpass -p '{password}' rsync ... command using str_replace with no shell escaping. An unauthenticated remote attacker can chain a cross-site request forgery (CSRF) against an authenticated administrator to plant a malicious password and cloneSiteURL. The plugin's documented crontab entry then executes the injected command as the cron owner, commonly root or www-data. This issue is a residual sink of CVE-2026-41304 and is confirmed at master HEAD (8963b6a1).

Critical Impact
Remote code execution as root or www-data on the AVideo host, achieved without any interaction beyond a lured administrator visiting an attacker-controlled page.

Affected Products

WWBN AVideo through version 29.0
AVideo master branch at commit 8963b6a1
Deployments running the CloneSite plugin with the documented crontab installed

Discovery Timeline

2026-09-16 - CVE-2026-92580 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92580

Vulnerability Analysis

The CloneSite plugin stores an SSH password supplied through the admin-only endpoint objects/pluginAddDataObject.json.php. When the clone job runs, cloneClient.json.php builds a shell command by substituting that password into the template sshpass -p '{password}' rsync ... using PHP's str_replace. Because no escaping is applied, a single quote in the stored password terminates the quoted argument and injects arbitrary shell syntax. The injected command executes under the crontab owner, which is typically root or www-data, yielding full host compromise. This is classified as OS Command Injection [CWE-78].

Root Cause

Two defects combine. First, cloneClient.json.php performs unsafe string interpolation into a shell command without calling escapeshellarg on the password or URL. Second, the CSRF guard isUntrustedRequest() / forbidIfIsUntrustedRequest() on the plugin data endpoint is a no-op when the request source appears to originate from loopback. Behind a same-host TLS-terminating reverse proxy with $global['trustedProxies'] unset, or when an attacker-controlled application is co-hosted on the same hostname, the guard silently passes. Over HTTPS, the session cookie is issued with SameSite=None, so a cross-site POST carries administrator credentials.

Attack Vector

An unauthenticated attacker hosts a page that issues a cross-site POST to objects/pluginAddDataObject.json.php. The request writes an attacker-chosen SSH password containing shell metacharacters and an attacker-controlled cloneSiteURL. When an authenticated administrator visits the page, the browser attaches the SameSite=None session cookie and the CSRF stub returns success. No further administrator action is required. The documented CloneSite crontab entry later invokes cloneClient.json.php, which builds the sshpass command and executes the injected shell payload. Default single-process Apache deployments are reported as not CSRF-exploitable.

No verified proof-of-concept code is published. See the GitHub Security Advisory and the VulnCheck Stored Shell Injection Advisory for technical details.

Detection Methods for CVE-2026-92580

Indicators of Compromise

Unexpected child processes of sshpass, rsync, PHP-FPM, or Apache workers spawning shells such as /bin/sh -c, bash, nc, curl, or wget.
CloneSite plugin configuration rows in the plugins table containing single quotes, backticks, $(, or ; inside the stored SSH password or cloneSiteURL fields.
Cron-triggered outbound network connections to hosts not matching legitimate clone destinations.

Detection Strategies

Inspect the AVideo database for CloneSite plugin records and flag any password or URL field containing shell metacharacters.
Monitor process ancestry for cron or web-server users invoking interpreters that were not part of the CloneSite workflow.
Alert on POST requests to objects/pluginAddDataObject.json.php whose Referer or Origin header is absent or off-domain.

Monitoring Recommendations

Enable web-server access logging with Referer and Origin headers preserved and forward to a central SIEM for correlation.
Log all cron job stdout and stderr for the AVideo user and review for shell errors indicating injection attempts.
Track file integrity on plugin/CloneSite/ and any files writable by www-data or root under the AVideo web root.

How to Mitigate CVE-2026-92580

Immediate Actions Required

Disable the CloneSite plugin in the AVideo administrative interface until a patched release is available.
Remove the CloneSite crontab entry so no command is built from stored plugin data.
Audit stored CloneSite passwords and cloneSiteURL values for shell metacharacters and reset any compromised SSH credentials.
Force administrator re-authentication and invalidate active sessions to close open CSRF windows.

Patch Information

No patched version is available at the time of publication. The issue is confirmed at master HEAD commit 8963b6a1 and is a residual sink of CVE-2026-41304. Track the GitHub Security Advisory for fix availability.

Workarounds

Set $global['trustedProxies'] in the AVideo configuration to the address of any TLS-terminating reverse proxy so loopback detection cannot be spoofed.
Do not co-host untrusted applications on the same hostname as an AVideo administrative interface.
Restrict administrative access to a dedicated hostname or VPN and require reauthentication with short session lifetimes.
Change the session cookie SameSite attribute to Lax or Strict where the deployment topology allows it, breaking the cross-site POST channel.

bash

# Configuration example - set trusted proxy and disable CloneSite plugin
# In videos/configuration.php
$global['trustedProxies'] = ['127.0.0.1', '::1'];

# Remove the CloneSite cron entry
crontab -e
# delete the line invoking plugin/CloneSite/cloneClient.json.php

# Disable the plugin via CLI (adjust DB credentials)
mysql -u avideo -p avideo -e "UPDATE plugins SET status='INACTIVE' WHERE name='CloneSite';"