CVE-2026-41058 is a path traversal vulnerability (CWE-22) in WWBN AVideo up to version 29.0. The issue arises from an incomplete fix in the CloneSite feature's deleteDump GET parameter, which fails to properly filter path traversal sequences ('../../'). This allows an attacker with at least low privileges to invoke unlink() on arbitrary files, potentially causing denial of service or integrity loss. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with network attack vector, low attack complexity, and no user interaction required. A code commit has been identified that updates the fix, but no official patch or advisory is referenced.

Successful exploitation allows an attacker with low privileges to delete arbitrary files on the affected system, impacting integrity and availability. There is no confidentiality impact reported. The vulnerability could lead to denial of service or disruption of service by removing critical files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The referenced commit suggests a fix exists in the source code repository, so upgrading to a version including this commit or applying the fix manually is recommended once official guidance is available. Until then, restrict access to the vulnerable parameter and monitor for suspicious activity related to file deletion attempts.