{"items":[{"id":"NVI-00005833","kind":"vulnerability","title":"WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal","revision":5,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-5879-4fmr-xwf2","CVE-2026-41058"],"plain_summary":"OSV carries this publisher advisory for wwbn/avideo. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0cd7eee6789391e7e5353ddf24f91efc"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T21:10:00.170Z","value":"8.1 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-be1570dd6d3383e9fb335fdfc17cd1f4"},{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.469%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.40706. Missing scores are unknown.","source_id":"sr-0cd7eee6789391e7e5353ddf24f91efc"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9e6193e8e9930e41437e88e6dc508faf","url":"https://github.com/advisories/GHSA-5879-4fmr-xwf2","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-5879-4fmr-xwf2","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.679Z"},{"id":"sr-be1570dd6d3383e9fb335fdfc17cd1f4","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41058","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-41058","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T07:23:52.242Z"},{"id":"sr-0cd7eee6789391e7e5353ddf24f91efc","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-41058","publisher":"FIRST EPSS","observed_at":"2026-11-04T17:58:50.326Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9e6193e8e9930e41437e88e6dc508faf"],"technology":"wwbn/avideo","known_exclusions":[],"conditions_summary":"### Summary\n\nThe incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter.\n\n### Affected Package\n\n- **Ecosystem:** Other\n- **Package:** AVideo\n- **Affected versions:** = commit 941decd6d19e\n\n### Details\n\nAt line 44-48 of `cloneServer.json.php` (pre-fix):\n```php\nif (!empty($_GET['deleteDump'])) {\n    $resp->error = !unlink(\"{$clonesDir}{$_GET['deleteDump']}\");\n    $resp->msg = \"Delete Dump {$_GET['deleteDump']}\";\n    die(json_encode($resp));\n}\n```\n\nNo `basename()`, no `realpath()` check, no path traversal filtering. `$_GET['deleteDump']` is concatenated directly with `$clonesDir`.\n\nThe vulnerable code has zero protection against path traversal:\n- No `basename()` to strip directory components\n- No `realpath()` to validate the final path\n- No check that resolved path is within `$clonesDir`\n- No `../` sanitization\n- Additionally, `exec()` calls with `mysqldump` pass credentials on the command line\n\n### PoC\n\n```python\n\"\"\"\nCVE-2026-33293 - AVideo CloneSite Path Traversal\n\"\"\"\n\nimport sys\nimport os\n\nVULN_SRC = os.path","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 29.0"]}],"null_published_at":"2026-11-07T22:29:23.379Z","source_updated_at":"2026-07-08T08:29:24.069Z","source_disclosed_at":"2026-04-14T23:21:31.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:41:49.679Z"},{"id":"NVI-00005833","kind":"vulnerability","title":"WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5879-4fmr-xwf2","CVE-2026-41058"],"plain_summary":"OSV carries this publisher advisory for wwbn/avideo. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0cd7eee6789391e7e5353ddf24f91efc"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.469%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.40706. Missing scores are unknown.","source_id":"sr-0cd7eee6789391e7e5353ddf24f91efc"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9e6193e8e9930e41437e88e6dc508faf","url":"https://github.com/advisories/GHSA-5879-4fmr-xwf2","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-5879-4fmr-xwf2","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.679Z"},{"id":"sr-0cd7eee6789391e7e5353ddf24f91efc","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-41058","publisher":"FIRST EPSS","observed_at":"2026-11-04T17:58:50.326Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9e6193e8e9930e41437e88e6dc508faf"],"technology":"wwbn/avideo","known_exclusions":[],"conditions_summary":"### Summary\n\nThe incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter.\n\n### Affected Package\n\n- **Ecosystem:** Other\n- **Package:** AVideo\n- **Affected versions:** = commit 941decd6d19e\n\n### Details\n\nAt line 44-48 of `cloneServer.json.php` (pre-fix):\n```php\nif (!empty($_GET['deleteDump'])) {\n    $resp->error = !unlink(\"{$clonesDir}{$_GET['deleteDump']}\");\n    $resp->msg = \"Delete Dump {$_GET['deleteDump']}\";\n    die(json_encode($resp));\n}\n```\n\nNo `basename()`, no `realpath()` check, no path traversal filtering. `$_GET['deleteDump']` is concatenated directly with `$clonesDir`.\n\nThe vulnerable code has zero protection against path traversal:\n- No `basename()` to strip directory components\n- No `realpath()` to validate the final path\n- No check that resolved path is within `$clonesDir`\n- No `../` sanitization\n- Additionally, `exec()` calls with `mysqldump` pass credentials on the command line\n\n### PoC\n\n```python\n\"\"\"\nCVE-2026-33293 - AVideo CloneSite Path Traversal\n\"\"\"\n\nimport sys\nimport os\n\nVULN_SRC = os.path","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 29.0"]}],"null_published_at":"2026-11-07T14:01:58.756Z","source_updated_at":"2026-07-08T08:29:24.069Z","source_disclosed_at":"2026-04-14T23:21:31.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:49.679Z"},{"id":"NVI-00005833","kind":"vulnerability","title":"WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5879-4fmr-xwf2","CVE-2026-41058"],"plain_summary":"OSV carries this publisher advisory for wwbn/avideo. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-18e7fce6ff42bc13ba265a8c10e553b5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"0.469%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.4058. Missing scores are unknown.","source_id":"sr-18e7fce6ff42bc13ba265a8c10e553b5"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9e6193e8e9930e41437e88e6dc508faf","url":"https://github.com/advisories/GHSA-5879-4fmr-xwf2","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-5879-4fmr-xwf2","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.679Z"},{"id":"sr-18e7fce6ff42bc13ba265a8c10e553b5","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-41058","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:15:58.852Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9e6193e8e9930e41437e88e6dc508faf"],"technology":"wwbn/avideo","known_exclusions":[],"conditions_summary":"### Summary\n\nThe incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter.\n\n### Affected Package\n\n- **Ecosystem:** Other\n- **Package:** AVideo\n- **Affected versions:** = commit 941decd6d19e\n\n### Details\n\nAt line 44-48 of `cloneServer.json.php` (pre-fix):\n```php\nif (!empty($_GET['deleteDump'])) {\n    $resp->error = !unlink(\"{$clonesDir}{$_GET['deleteDump']}\");\n    $resp->msg = \"Delete Dump {$_GET['deleteDump']}\";\n    die(json_encode($resp));\n}\n```\n\nNo `basename()`, no `realpath()` check, no path traversal filtering. `$_GET['deleteDump']` is concatenated directly with `$clonesDir`.\n\nThe vulnerable code has zero protection against path traversal:\n- No `basename()` to strip directory components\n- No `realpath()` to validate the final path\n- No check that resolved path is within `$clonesDir`\n- No `../` sanitization\n- Additionally, `exec()` calls with `mysqldump` pass credentials on the command line\n\n### PoC\n\n```python\n\"\"\"\nCVE-2026-33293 - AVideo CloneSite Path Traversal\n\"\"\"\n\nimport sys\nimport os\n\nVULN_SRC = os.path","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 29.0"]}],"null_published_at":"2026-11-06T00:30:00.627Z","source_updated_at":"2026-07-08T08:29:24.069Z","source_disclosed_at":"2026-04-14T23:21:31.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:49.679Z"},{"id":"NVI-00005833","kind":"vulnerability","title":"WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5879-4fmr-xwf2","CVE-2026-41058"],"plain_summary":"OSV carries this publisher advisory for wwbn/avideo. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-59a415133199c060364e4fee0350b9ab"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.469%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.40602. Missing scores are unknown.","source_id":"sr-59a415133199c060364e4fee0350b9ab"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9e6193e8e9930e41437e88e6dc508faf","url":"https://github.com/advisories/GHSA-5879-4fmr-xwf2","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-5879-4fmr-xwf2","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.679Z"},{"id":"sr-59a415133199c060364e4fee0350b9ab","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-41058","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.378Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9e6193e8e9930e41437e88e6dc508faf"],"technology":"wwbn/avideo","known_exclusions":[],"conditions_summary":"### Summary\n\nThe incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter.\n\n### Affected Package\n\n- **Ecosystem:** Other\n- **Package:** AVideo\n- **Affected versions:** = commit 941decd6d19e\n\n### Details\n\nAt line 44-48 of `cloneServer.json.php` (pre-fix):\n```php\nif (!empty($_GET['deleteDump'])) {\n    $resp->error = !unlink(\"{$clonesDir}{$_GET['deleteDump']}\");\n    $resp->msg = \"Delete Dump {$_GET['deleteDump']}\";\n    die(json_encode($resp));\n}\n```\n\nNo `basename()`, no `realpath()` check, no path traversal filtering. `$_GET['deleteDump']` is concatenated directly with `$clonesDir`.\n\nThe vulnerable code has zero protection against path traversal:\n- No `basename()` to strip directory components\n- No `realpath()` to validate the final path\n- No check that resolved path is within `$clonesDir`\n- No `../` sanitization\n- Additionally, `exec()` calls with `mysqldump` pass credentials on the command line\n\n### PoC\n\n```python\n\"\"\"\nCVE-2026-33293 - AVideo CloneSite Path Traversal\n\"\"\"\n\nimport sys\nimport os\n\nVULN_SRC = os.path","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 29.0"]}],"null_published_at":"2026-11-01T01:45:38.520Z","source_updated_at":"2026-07-08T08:29:24.069Z","source_disclosed_at":"2026-04-14T23:21:31.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:49.679Z"},{"id":"NVI-00005833","kind":"vulnerability","title":"WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5879-4fmr-xwf2","CVE-2026-41058"],"plain_summary":"OSV carries this publisher advisory for wwbn/avideo. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-9e6193e8e9930e41437e88e6dc508faf"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9e6193e8e9930e41437e88e6dc508faf","url":"https://github.com/advisories/GHSA-5879-4fmr-xwf2","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-5879-4fmr-xwf2","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.679Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9e6193e8e9930e41437e88e6dc508faf"],"technology":"wwbn/avideo","known_exclusions":[],"conditions_summary":"### Summary\n\nThe incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter.\n\n### Affected Package\n\n- **Ecosystem:** Other\n- **Package:** AVideo\n- **Affected versions:** = commit 941decd6d19e\n\n### Details\n\nAt line 44-48 of `cloneServer.json.php` (pre-fix):\n```php\nif (!empty($_GET['deleteDump'])) {\n    $resp->error = !unlink(\"{$clonesDir}{$_GET['deleteDump']}\");\n    $resp->msg = \"Delete Dump {$_GET['deleteDump']}\";\n    die(json_encode($resp));\n}\n```\n\nNo `basename()`, no `realpath()` check, no path traversal filtering. `$_GET['deleteDump']` is concatenated directly with `$clonesDir`.\n\nThe vulnerable code has zero protection against path traversal:\n- No `basename()` to strip directory components\n- No `realpath()` to validate the final path\n- No check that resolved path is within `$clonesDir`\n- No `../` sanitization\n- Additionally, `exec()` calls with `mysqldump` pass credentials on the command line\n\n### PoC\n\n```python\n\"\"\"\nCVE-2026-33293 - AVideo CloneSite Path Traversal\n\"\"\"\n\nimport sys\nimport os\n\nVULN_SRC = os.path","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 29.0"]}],"null_published_at":"2026-10-31T22:13:05.840Z","source_updated_at":"2026-07-08T08:29:24.069Z","source_disclosed_at":"2026-04-14T23:21:31.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:49.679Z"}],"next_cursor":null,"snapshot_revision":"42594"}