CVE-2026-92580
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
The CloneSite plugin in AVideo through version 29.0 contains a stored OS command injection vulnerability. The stored SSH password is substituted into the command `sshpass -p '{password}' rsync ...` using plain str_replace without escaping, allowing a single quote to break out and inject arbitrary shell commands. Exploitation requires luring an authenticated administrator into planting a malicious password via a CSRF vector, followed by execution via the documented crontab entry.
Risk Assessment
The risk to the organization includes remote unauthenticated attackers potentially gaining control of the server by abusing an administrator's session to inject commands executed as the crontab owner (often root). This can lead to full system compromise, data theft, or malware installation.
Recommendation
Immediately disable the CloneSite plugin and remove the crontab entry if not essential. Update AVideo to a patched version as soon as available, and harden CSRF defenses (e.g., set trustedProxies and enforce SameSite=Lax for session cookies).
Other vulnerabilities in AVideo
See all- CVE-2026-89255High
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafted public key, which executes in an administrator's session when viewing the user's profile tab.
- CVE-2026-89253High
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() stores the value and save() validates it only with filter_var(..., FILTER_VALIDATE_URL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only strip_tags() and does not encode double quotes. An authenticated user who updates their own profile can break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor, including an administrator.
- CVE-2026-89250High
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to download recorded live video files without authentication or authorization checks.
- CVE-2026-89248Medium
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request the endpoint and receive JSON containing the absolute filesystem path of the WebRTC2RTMP helper binary, the configured WebRTC port, file_exists/is_executable status, log contents, and port reachability information.
- CVE-2026-89245Medium
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to playlistRemove.php.
- CVE-2026-89240Medium
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The unauthenticated GET parameter u is interpolated directly into an img src attribute without URL- or HTML-encoding, allowing injection of an additional tag with an onerror handler.
- CVE-2026-89148Medium
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a *.json.php script, AVideo's automatic CSRF guard (autoCSRFGuard()/forbidIfIsUntrustedRequest()) does not run, and when the request includes the sort parameter the script issues a Location header set to the unvalidated $_SERVER['HTTP_REFERER'] value without calling isSafeRedirectURL(). A remote unauthenticated attacker can therefore induce a logged-in user who can manage the targeted playlist to submit a cross-origin POST with a crafted Referer, causing the victim's playlist to be reordered and the victim's browser to be redirected from a trusted AVideo URL to an attacker-controlled site for phishing. No patched version is available.
- CVE-2026-88874High
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::_getStats() returns a password-protected transmission's RTMP stream key, isPasswordProtected flag, and HLS URL to unauthenticated callers, and the shipped NGINX configuration serves the .m3u8 playlist, AES-128 key, and transport-stream segments without authentication.
- CVE-2026-88873High
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php. Unauthenticated attackers can archive application logs via GET requests without CSRF token validation, copying sensitive logs to a publicly accessible zip file and truncating the live log.
- CVE-2026-88872High
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint. Unauthenticated attackers can modify any user's channel password by sending a GET request without CSRF token validation.
Original NVD description (English source)
In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (line ~270) the stored SSH password is substituted into the command string `sshpass -p '{password}' rsync ...` with a plain str_replace and no escaping, so a single quote in the password breaks out of the quoted word and injects arbitrary shell. The password is written through the admin-only endpoint objects/pluginAddDataObject.json.php, whose only CSRF defense (isUntrustedRequest()/forbidIfIsUntrustedRequest()) is a no-op when the request source appears to be loopback — as happens behind a same-host TLS-terminating reverse proxy with $global['trustedProxies'] unset — or when an attacker-controlled application is co-hosted on the same hostname; on HTTPS the session cookie is issued with SameSite=None, so a cross-site POST carries it. An unauthenticated remote attacker can therefore lure an authenticated administrator into planting a malicious password (and an attacker-controlled cloneSiteURL), after which the plugin's documented crontab entry executes the injected command with no further administrator action, as the crontab owner (commonly root or www-data). Exploitation requires the CloneSite plugin to be enabled with the documented crontab installed and one of the above CSRF channels; default single-process Apache deployments are reported as not CSRF-exploitable. This is a residual sink of CVE-2026-41304. The issue is confirmed at master HEAD (8963b6a1); no patched version is available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS