AVideo <= 26.0 - WWBN AVideo - Remote Code Execution

criticalseverity

13.5%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

WWBN AVideo <= 26.0 contains multiple vulnerabilities in the CloneSite plugin including unauthenticated exposure of clone secret keys and OS command injection in rsync command construction, letting unauthenticated attackers achieve remote code execution.

Impact

Unauthenticated attackers can execute arbitrary system commands, leading to full server compromise.

Fix

Update to the version including commit c85d076375fab095a14170df7ddb27058134d38c or later.

How to confirm it

Send: GET /plugin/CloneSite/clones.json.php
Positive when: contains "{\"data\": [" and "\"key\":\"" AND contains in content_type "application/json" AND not contains "\"error\"" or "Admin required" AND status 200

Run it with nuclei: nuclei -id CVE-2026-33478 -u <target>

The full check

id: CVE-2026-33478

info:
  name: AVideo <= 26.0 - WWBN AVideo - Remote Code Execution
  author: pussycat0x
  severity: critical
  description: |
    WWBN AVideo <= 26.0 contains multiple vulnerabilities in the CloneSite plugin including unauthenticated exposure of clone secret keys and OS command injection in rsync command construction, letting unauthenticated attackers achieve remote code execution.
  impact: |
    Unauthenticated attackers can execute arbitrary system commands, leading to full server compromise.
  remediation: |
    Update to the version including commit c85d076375fab095a14170df7ddb27058134d38c or later.
  reference:
    - https://github.com/WWBN/AVideo/security/advisories/GHSA-687q-32c6-8x68
  metadata:
    max-request: 1
    verified: true
    shodan-query: http.html:"AVideo"
    fofa-query: app="AVideo-YouPHPTube"
  tags: cve,cve2026,avideo,clonesite,unauth,oss,vkev

http:
  - raw:
      - |
        GET /plugin/CloneSite/clones.json.php HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"data": ['
          - '"key":"'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: word
        part: body
        words:
          - '"error"'
          - "Admin required"
        negative: true
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: key
        group: 1
        part: body
        regex:
          - '"key":"([0-9a-z]+)"'

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-687q-32c6-8x68

Use this check only on systems you are authorised to test. Where the data comes from