Command injection in AVideo - CVE-2026-41304
Published: November 11, 2026
Vulnerability identifier: #VU165913
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41304
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary shell commands and PHP code as the web server user.
The vulnerability exists due to command injection in AVideo's CloneSite plugin when cloneClient.json.php removes quotes added by escapeshellarg() before constructing a wget command executed through exec(). A remote privileged user can configure cloneSiteURL to reference a malicious server and contain shell metacharacters such as ;, then access plugin/CloneSite/cloneClient.json.php to execute commands and create a web shell.
Affected software
AVideo
How to mitigate CVE-2026-41304
Install security update from vendor's website.
AVideo - update to 29.1.0