CVE-2026-41058
Published: 21 April 2026
Summary
CVE-2026-41058 is a high-severity Path Traversal (CWE-22) vulnerability in Wwbn Avideo. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-41058 is a path traversal vulnerability (CWE-22) in WWBN AVideo, an open source video platform, affecting versions 29.0 and below. The issue stems from an incomplete fix in the CloneSite `deleteDump` parameter, which lacks proper path traversal filtering. This allows attackers to supply `../../` sequences via a GET parameter to invoke `unlink()` on arbitrary files on the server. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
A low-privileged authenticated user (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity and no user interaction required. Successful exploitation enables deletion of arbitrary files, resulting in high integrity (I:H) and availability (A:H) impacts but no confidentiality loss (C:N).
GitHub security advisories, including GHSA-5879-4fmr-xwf2, GHSA-xmjm-86qv-g226, and GHSA-5879-4fmr-xwf2, document the flaw and reference prior related issues. Mitigation is available in commit 3c729717c26f160014a5c86b0b6accdbd613e7b2, which provides an updated fix; an earlier commit 941decd6d19e2e694acb75e86317d10fbb560284 contained only a partial remediation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24535
Vulnerability details
WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter. Commit…
more
3c729717c26f160014a5c86b0b6accdbd613e7b2 contains an updated fix.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing web app (AVideo) directly enables remote exploitation for arbitrary file deletion via unlink().
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the deleteDump GET parameter to block path traversal sequences like ../../ that enable arbitrary unlink() calls.
Mandates enforcement mechanisms in the application to restrict file access and deletion to authorized paths only, preventing low-privileged users from targeting arbitrary files.
Requires timely identification, prioritization, and patching of flaws like this incomplete path traversal fix, referencing the provided remediation commit.