Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly to `unlink()` without any path sanitization. An attacker with valid clone credentials can use path traversal sequences (e.g., `../../`) to delete arbitrary files on the server, including critical application files such as `configuration.php`, causing complete denial of service or enabling further attacks by removing security-critical files. Version 26.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-22 | 2 | Disclosure1General1 |
| 2026-03-23 | 1 | Disclosure1 |
CVE-2026-33293 Path Traversal in WWBN AVideo Before 26.0 Enables Arbitrary File Deletion https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33293
Post summary
A path traversal flaw in WWBN AVideo versions prior to 26.0 allows arbitrary file deletion; the post provides a link to vulnerability details but no PoC, exploit, or patch information.
CVE-2026-33293 WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly to `unli… https://www.cve.org/CVERecord?id=CVE-2026-33293
Post summary
CVE‑2026‑33293 affects WWBN AVideo versions prior to 26.0, where the deleteDump parameter is unsafely passed to a backend utility. The excerpt offers a brief technical detail but lacks a PoC, exploit, patch, or evidence of active exploitation.
🟠 CVE-2026-33293 - High WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly to `unlink()` without any path sa... https://www.thehackerwire.com/vulnerability/CVE-2026-33293/ https://t.co/Kyi33k3Q0K
Post summary
The post announces a high‑severity vulnerability in WWBN AVideo (CVE‑2026‑33293) that allows arbitrary file deletion via an unsanitized deleteDump parameter; no PoC or exploit code is mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wwbn | avideo | - | - | - |