CVE-2026-29058 AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php
Unauthenticated attackers can execute arbitrary OS commands via the base64Url parameter in AVideo, leading to server compromise and data exfiltration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29058?
CVE-2026-29058 is a critical command injection vulnerability in WWBN AVideo-Encoder, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption. This issue has been patched in version 7.0.
Weakness: CWE-78
Which versions are affected by CVE-2026-29058?
2 open source packages ship an affected version, including wwbn/avideo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wwbn/avideo Packagist | All versions | 7.0.0 |
wwbn/avideo Packagist | All versions | 7.0.0 |
Products include Wwbn Avideo-Encoder.
How do I fix CVE-2026-29058?
Upgrade wwbn/avideo to 7.0.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-29058 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29058 exists.
Public exploit code: 1 Metasploit module and 1 Nuclei template.
Other vulnerabilities in WWBN AVideo-Encoder
Sources
Also known as GHSA-9j26-99jh-v26q.