CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
Unauthenticated attackers can achieve remote code execution by chaining clone key disclosure, database dumping, and OS command injection in the CloneSite plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33478?
CVE-2026-33478 is a critical command injection vulnerability in Wwbn Avideo, published on 23 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. The `clones.json.php` endpoint exposes clone secret keys without authentication, which can be used to trigger a full database dump via `cloneServer.json.php`. The dump contains admin password hashes stored as MD5, which are trivially crackable. With admin access, the attacker exploits an OS command injection in the rsync command construction in `cloneClient.json.php` to execute arbitrary system commands. Commit c85d076375fab095a14170df7ddb27058134d38c contains a patch.
Which versions are affected by CVE-2026-33478?
2 open source packages ship an affected version, including wwbn/avideo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wwbn/avideo Packagist | All versions to 26.0 | None |
wwbn/avideo Packagist | All versions to 26.0 | None |
Products include Wwbn Avideo.
How do I fix CVE-2026-33478?
No fix has been published for CVE-2026-33478 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-33478 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33478 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Wwbn Avideo
- CVE-2026-40911 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
- CVE-2022-30534 Command injection in AVideo
- CVE-2022-30547 Path traversal in AVideo
- CVE-2022-32572 Command injection in AVideo
- CVE-2026-33352 AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
Sources
Also known as GHSA-687q-32c6-8x68.