CVE-2026-41304

WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands using user-controlled input (`url` parameter) without proper sanitization. The input is directly concatenated into a `wget` command executed via `exec()`, allowing command injection. An attacker can inject arbitrary shell commands by breaking out of the intended URL context using shell metacharacters (e.g., `;`). This leads to Remote Code Execution (RCE) on the server. Commit 473c609fc2defdea8b937b00e86ce88eba1f15bb contains a fix.

• CWE-77

• https://github.com/WWBN/AVideo/commit/473c609fc2defdea8b937b00e86ce88eba1f15bbPatch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-xr6f-h4x7-r6qpExploit, Mitigation, Vendor Advisory
• https://github.com/WWBN/AVideo/security/advisories/GHSA-xr6f-h4x7-r6qpExploit, Mitigation, Vendor Advisory

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41298OpenClaw before 2026.4.2 fails to enforce write scopes on th…5.4
• CVE-2026-41299OpenClaw before 2026.3.28 contains an authorization bypass v…7.1
• CVE-2026-41300OpenClaw before 2026.3.31 contains a trust-decline vulnerabi…6.9
• CVE-2026-41301OpenClaw versions 2026.3.22 before 2026.3.31 contain a signa…6.9
• CVE-2026-41302OpenClaw before 2026.3.31 contains a server-side request for…6.3
• CVE-2026-41303OpenClaw before 2026.3.28 contains an authorization bypass v…8.8
• CVE-2026-41305PostCSS takes a CSS file and provides an API to analyze and …6.1
• CVE-2026-41308Password Pusher is an open source application to communicate…6.5
• CVE-2026-41309Open Source Social Network (OSSN) is open-source social netw…8.2
• CVE-2026-4131The WP Responsive Popup + Optin plugin for WordPress is vuln…6.1
• CVE-2026-41310OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter fo…5.3
• CVE-2026-41311LiquidJS is a Shopify / GitHub Pages compatible template eng…6.5