CVE-2026-64625 AVideo before 29.0 OS Command Injection via execAsync
Attackers can execute arbitrary OS commands via the Live plugin endpoint due to improper command escaping in AVideo.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-64625?
CVE-2026-64625 is a critical command injection vulnerability in WWBN AVideo, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.
Weakness: CWE-78
Which versions are affected by CVE-2026-64625?
How do I fix CVE-2026-64625?
No fix has been published for CVE-2026-64625 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-64625 being exploited?
There is no known exploitation of CVE-2026-64625 in the wild and no public exploit code.
Sources
Also known as GHSA-9h6c-phqv-934p, GHSA-rc5x-vh5v-473f.