Attack Chain

1. The attacker identifies an AVideo instance running version 29.0 or below.
2. The attacker crafts a malicious HTTP GET request targeting the CloneSite functionality.
3. The attacker injects a path traversal sequence (e.g., ../../) into the deleteDump parameter of the GET request.
4. The AVideo application fails to properly sanitize the deleteDump parameter.
5. The unlink() function is called with the attacker-controlled path, allowing deletion of arbitrary files.
6. The attacker uses the vulnerability to delete critical system files or configuration files.
7. The application or server becomes unstable or inoperable.

Impact

Successful exploitation of CVE-2026-41058 allows unauthenticated attackers to delete arbitrary files on the AVideo server. This can lead to denial of service, data loss, or potential privilege escalation if critical system files are deleted. The vulnerability affects all AVideo instances running version 29.0 or below, potentially impacting a large number of users and organizations relying on the platform.

Recommendation

• Upgrade AVideo instances to a version containing the fix from commit 3c729717c26f160014a5c86b0b6accdbd613e7b2 to address CVE-2026-41058.
• Deploy the Sigma rule Detect AVideo Path Traversal Attempt to identify exploitation attempts in web server logs.
• Implement web application firewall (WAF) rules to block requests containing path traversal sequences in the deleteDump parameter.
• Monitor web server logs for suspicious activity related to the CloneSite functionality and the deleteDump parameter.