CVE-2026-41058
WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter. Commit 3c729717c26f160014a5c86b0b6accdbd613e7b2 contains an updated fix.
취약점 유형
WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter. Commit 3c729717c26f160014a5c86b0b6accdbd613e7b2 contains an updated fix.
영향받는 제품
- wwbn avideo
참고 자료
- https://github.com/WWBN/AVideo/commit/3c729717c26f160014a5c86b0b6accdbd613e7b2
- https://github.com/WWBN/AVideo/commit/941decd6d19e2e694acb75e86317d10fbb560284
- https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2
- https://github.com/WWBN/AVideo/security/advisories/GHSA-xmjm-86qv-g226
- https://github.com/WWBN/AVideo/security/advisories/GHSA-5879-4fmr-xwf2
공격자보다 먼저 취약점을 찾으세요.
GitHub로 로그인하고 1분 안에 첫 감사를 실행하세요. 무료 플랜은 신용카드가 필요 없습니다.