CVE-2026-41058 PUBLISHED

AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo

Assigner: GitHub_M
Reserved: 16.04.2026 Published: 21.04.2026 Updated: 21.04.2026

WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite deleteDump parameter does not apply path traversal filtering, allowing unlink() of arbitrary files via ../../ sequences in the GET parameter. Commit 3c729717c26f160014a5c86b0b6accdbd613e7b2 contains an updated fix.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS Score: 8.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	WWBN
Product	AVideo
Versions	Version <= 29.0 is affected

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2
https://github.com/WWBN/AVideo/security/advisories/GHSA-xmjm-86qv-g226
https://github.com/WWBN/AVideo/commit/3c729717c26f160014a5c86b0b6accdbd613e7b2
https://github.com/WWBN/AVideo/commit/941decd6d19e2e694acb75e86317d10fbb560284

Problem Types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE