CVE-2026-33293 | WWBN AVideo up to 25.x cloneServer.json.php unlink deleteDump path traversal

A vulnerability has been found in WWBN AVideo up to 25.x and classified as critical. Impacted is the function unlink of the file plugin/CloneSite/cloneServer.json.php. Performing a manipulation of the argument deleteDump results in path traversal.

This vulnerability is reported as CVE-2026-33293. The attack is possible to be carried out remotely. No exploit exists.

The affected component should be upgraded.