WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter. Commit 3c729717c26f160014a5c86b0b6accdbd613e7b2 contains an updated fix.
Cite this page
CVE-2026-41058. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-41058
Use CWE-22, Wwbn vendor hub and Avideo product page to widen CVE-2026-41058 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2026-41064, CVE-2026-41304 and CVE-2026-41055 for nearby disclosures in the same product family.