/Vulnerability Library

AVideo <= 26.0 - WWBN AVideo - Remote Code Execution

CVE-2026-33478
Verified

Description

WWBN AVideo <= 26.0 contains multiple vulnerabilities in the CloneSite plugin including unauthenticated exposure of clone secret keys and OS command injection in rsync command construction, letting unauthenticated attackers achieve remote code execution.

Severity

Critical

Published Date

April 7, 2026

Template Author

pussycat0x

CVE-2026-33478.yaml
9.5Severity

CVSS Metrics

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-687q-32c6-8x68

Remediation Steps

Update to the version including commit c85d076375fab095a14170df7ddb27058134d38c or later.