An incomplete patch in AVideo’s CloneSite feature leaves the deleteDump GET parameter without any path‑traversal filtering. An attacker who can send crafted URLs that contain "../../" sequences can cause the server to execute unlink() on arbitrary files. The result is unauthorized deletion of files on the host, which can lead to data loss, service disruption, or further compromise if critical system files are targeted.

WWBN AVideo versions 29.0 and earlier are affected. These releases lack the full path‑validation logic that was added in commit 3c729717c26f160014a5c86b0b6accdbd613e7b2.

The CVSS score of 8.1 classifies this flaw as high severity, and although EPSS data is not available, the weakness is present in a publicly reachable web endpoint, making remote exploitation feasible. The vulnerability is not listed in the CISA KEV catalog, but the lack of mitigation in affected releases poses a significant risk to exposed installations.