by Kastro
Paper/Archive/CVE-2026-29058

CVE-2026-29058

WWBN AVideo-Encoder — AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php

EPSS 9%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 95.2.952 × 2019.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption. This issue has been patched in version 7.0.

Affected

ProductAffectedFixed inSource
AVideo-Encoder< 7.0–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/WWBN/AVideo-Encoder/security/advisories/GHSA-9j26-99jh-v26q