CVE-2026-92580

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (line ~270) the stored SSH password is substituted into the command string `sshpass -p '{password}' rsync ...` with a plain str_replace and no escaping, so a single quote in the password breaks out of the quoted word and injects arbitrary shell. The password is written through the admin-only endpoint objects/pluginAddDataObject.json.php, whose only CSRF defense (isUntrustedRequest()/forbidIfIsUntrustedRequest()) is a no-op when the request source appears to be loopback — as happens behind a same-host TLS-terminating reverse proxy with $global['trustedProxies'] unset — or when an attacker-controlled application is co-hosted on the same hostname; on HTTPS the session cookie is issued with SameSite=None, so a cross-site POST carries it. An unauthenticated remote attacker can therefore lure an authenticated administrator into planting a malicious password (and an attacker-controlled cloneSiteURL), after which the plugin's documented crontab entry executes the injected command with no further administrator action, as the crontab owner (commonly root or www-data). Exploitation requires the CloneSite plugin to be enabled with the documented crontab installed and one of the above CSRF channels; default single-process Apache deployments are reported as not CSRF-exploitable. This is a residual sink of CVE-2026-41304. The issue is confirmed at master HEAD (8963b6a1); no patched version is available.

• CWE-78

• https://github.com/WWBN/AVideo/security/advisories/GHSA-g96r-pgr6-m7hh
• https://www.vulncheck.com/advisories/avideo-through-29.0-clonesite-stored-shell-injection-via-ssh-password-csrf

Published

Sep 16, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92571Rejected reason: CVE ID reserved in error and not assigned t…
• CVE-2026-92576HKUDS nanobot before 0.3.0 contains a server-side request fo…8.6
• CVE-2026-92577In AVideo through 29.0, the API get_api_video endpoint conta…7.5
• CVE-2026-92578WWBN AVideo through 29.0 contains an authentication bypass v…8.1
• CVE-2026-92579In AVideo through 29.0, the autoCSRFGuard() function maintai…5.4
• CVE-2026-9258Improper validation of SSH host keys in Canon EOS Network Se…9.8
• CVE-2026-92581In AVideo through 29.0, Like::__construct() performs counter…4.3
• CVE-2026-92582AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vuln…7.1
• CVE-2026-92583AVideo through 29.0 contains a race condition in the enforce…6.5
• CVE-2026-92584AVideo through 29.0 (current revision e01e41ecc) contains a …6.1
• CVE-2026-92585AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78…4.3
• CVE-2026-92586AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78…4.3