CVE-2026-64625

Received Received - Intake

AVideo Command Injection via Live Plugin

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-64625

EUVD

EUVD-2026-46119

Affected Vendors & Products

Vendor	Product	Version / Range
avideo	avideo	to 29.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

AVideo before version 29.0 has an incomplete fix for a previous vulnerability (CVE-2026-45578). The execAsync() function incorrectly wraps escaped commands in double quotes for the sh -c shell, allowing attackers to bypass protections using command substitution techniques like $() or backticks. This enables arbitrary OS command injection through the Live plugin's on_publish.php endpoint despite prior use of escapeshellarg().

Detection Guidance

To detect this vulnerability, inspect AVideo instances for versions before 29.0. Check the Live plugin's on_publish.php endpoint for improper command escaping. Monitor for unexpected command execution patterns or unauthorized system access via logs.

Impact Analysis

Attackers can execute arbitrary commands on the server hosting AVideo, potentially gaining full control over the system. This could lead to data theft, unauthorized access, or disruption of services. If you use AVideo for video streaming or related functions, your server and data may be at risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage depending on the data exposed.

Mitigation Strategies

Update AVideo to version 29.0 or later to address the incomplete fix for CVE-2026-45578. Review and restrict access to the Live plugin on_publish.php endpoint to prevent unauthorized command injection attempts.

Hi! I’m here to help you understand CVE-2026-64625. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70