The vulnerability resides in the deleteDump parameter of the cloneSite plugin for the AVideo video platform. This parameter is passed directly to the unlink() function without sanitization, enabling an attacker who gains valid clone credentials to inject path traversal sequences such as ../../. This allows deletion of any file accessible to the web server, including critical configuration files like configuration.php. The consequence is loss of service or facilitation of further attacks through removal of security‑critical components.

AVideo, an open‑source video hosting platform distributed by WWBN, is affected for all releases prior to version 26.0. Users operating any pre‑26.0 build are susceptible to this flaw.

The CVSS base score of 8.1 places this issue in the high‑severity range. An EPSS score below 1 % indicates a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. However, an attacker must possess clone credentials to craft the malicious deleteDump request. Once authenticated, the path traversal can be used to delete arbitrary files, causing immediate denial of service or enabling cascading attacks through removal of security files. Given the high impact and the need for authenticated access, the risk is considerable for any organization running vulnerable AVideo instances.