Vulnerability Description
WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter. Commit 3c729717c26f160014a5c86b0b6accdbd613e7b2 contains an updated fix.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wwbn | Avideo | <= 29.0 |
Related Weaknesses (CWE)
References
- https://github.com/WWBN/AVideo/commit/3c729717c26f160014a5c86b0b6accdbd613e7b2Patch
- https://github.com/WWBN/AVideo/commit/941decd6d19e2e694acb75e86317d10fbb560284Patch
- https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2ExploitMitigationVendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-xmjm-86qv-g226ExploitMitigationVendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-41058?
CVE-2026-41058 is a vulnerability with a CVSS score of 8.1 (HIGH). WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` ...
How severe is CVE-2026-41058?
CVE-2026-41058 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41058?
Check the references section above for vendor advisories and patch information. Affected products include: Wwbn Avideo.