CVE-2026-29058

AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php

State: Published
Severity: 9.8 Critical
Published: Mar 6, 2026
Updated: Mar 9, 2026
Reserved: Mar 3, 2026

Description

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption. This issue has been patched in version 7.0.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
AVideo-EncoderWWBN	< 7.0Affected

References

https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-9j26-99jh-v26q

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.