CVE-2026-92580 WWBN CVE debrief

Who should care

Administrators and users of the AVideo platform with the CloneSite plugin enabled should assess their exposure and take necessary actions to prevent exploitation. This includes reviewing and updating the plugin configuration, implementing additional CSRF defenses, and monitoring for suspicious activity.

Why it matters

The vulnerability in AVideo's CloneSite plugin allows for stored OS command injection via an SSH password and CSRF, posing a significant risk to administrators and users of the platform. The issue requires immediate attention to prevent exploitation and potential compromise of the platform.

• Remote code execution with elevated privileges
• Potential for lateral movement within the network
• Data tampering and unauthorized access
• Compromise of the AVideo platform and its users

Technical summary

The AVideo CloneSite plugin is vulnerable to stored OS command injection via an SSH password and CSRF. The vulnerability exists in the plugin/CloneSite/cloneClient.json.php file, where the stored SSH password is substituted into a command string without proper escaping. An unauthenticated remote attacker can lure an authenticated administrator into planting a malicious password and attacker-controlled cloneSiteURL, leading to command execution with no further administrator action.

Defensive priority

High

Recommended defensive actions

• Review and update the CloneSite plugin configuration to prevent exploitation
• Implement additional CSRF defenses for the pluginAddDataObject.json.php endpoint
• Monitor for suspicious activity related to the CloneSite plugin and crontab execution
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in AVideo's CloneSite plugin. The vulnerability allows for stored OS command injection via an SSH password and CSRF. The issue is confirmed at master HEAD (8963b6a1) with no patched version available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.