CVE-2026-41304 is a critical command injection flaw (CVSS 9.8) in the CloneSite plugin of WWBN AVideo, versions 29.0 and below. A user supplied URL is joined into a wget command run with exec(). The record points to a fix commit. Check your release and disable the plugin if unused.
What's affected
The record says AVideo versions 29.0 and below are affected, and that commit 473c609fc2defdea8b937b00e86ce88eba1f15bb contains a fix. The GitHub advisory lists no patched release number, so you should check the AVideo releases page for a version that includes that commit before you assume an upgrade covers you.
The vulnerable code is in the CloneSite plugin, specifically the cloneServer.json.php endpoint per the record.
How to check if you're exposed
Find your AVideo version in the admin area or in the project files, and see whether the CloneSite plugin is installed and enabled in the plugin manager. If it is not enabled, the exposure from this CVE is much smaller.
The advisory's walkthrough describes the attack path using an administrator session to set the clone site URL, even though the CVSS vector rates privileges as none. Read the advisory and decide how much weight to give that detail for your setup. Either way, who holds admin rights on your instance matters.
What to do now
- Update AVideo to a release that contains commit 473c609, or apply the commit if you maintain your own build.
- Disable the CloneSite plugin if you do not use it.
- Review the list of administrator accounts, and remove any you do not recognise.
- Check the web root for unexpected new files, and the web server logs for unusual calls to CloneSite endpoints.
- Run the web server as a low privilege user.
Why it matters
The record lists CWE-77, command injection. The advisory says the code tried to sanitize the value with escapeshellarg, and then removed the quote characters that function adds, which undid the protection and let shell metacharacters through to the final command.
That is a good example of a fix applied and then undone by the next line. When you escape for a shell, use the result as is. Better still, avoid building shell strings and call the program with an argument list. The record does not flag this CVE as known exploited.
Quick check
Is there a version number I can upgrade to?
The advisory lists none, only the fix commit. Check the project's release notes for the first release that includes it.
Sources
Last reviewed: 19 October 2026.
