A critical path traversal vulnerability in WWBN AVideo allows authenticated attackers to delete arbitrary files, potentially resulting in complete system disruption.

The application fails to properly sanitize the deleteDump parameter in the CloneSite component, which allows a remote authenticated attacker to use path traversal sequences to reach files outside the intended directory and execute an unlink operation.

The ability to arbitrarily delete files on the host server poses a significant risk to data integrity and system availability. An attacker could delete critical configuration files or core application components, leading to a total denial of service or the degradation of security controls. Given the CVSS score of 8.1, this represents a high-severity risk that could facilitate further system compromise or permanent data loss.

Immediate Action: As no official patched release is currently listed, administrators should restrict access to the CloneSite functionality or disable the affected component entirely until a fix is confirmed.

Proactive Monitoring: Review web server access logs for requests containing path traversal sequences, such as double dot slashes, directed at the CloneSite module.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming requests containing path traversal patterns in the deleteDump parameter.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to server stability and integrity. Organizations utilizing WWBN AVideo must prioritize securing the affected instance by restricting access to administrative functions and monitoring for unauthorized file deletion attempts. Security teams should track the vendor security advisories and apply the provided commit-level fixes or subsequent patches as soon as they become available.