Is CVE-2026-45578 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45578 being exploited in the wild.

How severe is CVE-2026-45578?

High severity, with a CVSS score of 8.8, published 29 May 2026.

Which products and versions are affected?

wwbn/avideo (Packagist) <= 29.0, ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0.

Is there a fix for CVE-2026-45578?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45578 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45578?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45578: WWBN AVideo OS command injection in Live plugin

Q: Is there a fix for CVE-2026-45578?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-45578 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-45578?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45578 · Severity: high · CVSS 8.8 · Published 2026-05-29

WWBN AVideo is an open-source video streaming and sharing platform. A security vulnerability in the Live plugin allows an authenticated user with streaming permissions to execute arbitrary commands on the underlying server. This could lead to a complete system takeover, unauthorized access to private videos, or the theft of sensitive configuration data and API keys.

Technologies: wwbn/avideo (Packagist), WWBN AVideo. Vendors: Packagist, WWBN.

Quick answers

Is CVE-2026-45578 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45578 being exploited in the wild.
How severe is CVE-2026-45578?: High severity, with a CVSS score of 8.8, published 29 May 2026.
Which products and versions are affected?: wwbn/avideo (Packagist) <= 29.0, ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0.
Is there a fix for CVE-2026-45578?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45578 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45578?: Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in `plugin/Live/on_publish.php` within the YPTSocket notification branch. The application constructs a shell command for `execAsync()` by concatenating variables (including `$m3u8` and `$users_id`) wrapped in literal single quotes without using `escapeshellarg()`. An attacker can inject a single quote to break out of the literal string and append arbitrary shell commands. This can be triggered by an authenticated user who can control their stream key (e.g., via `saveLive.php`), which is then used to generate the `$m3u8` URL. The endpoint is directly reachable via HTTP POST, bypassing typical RTMP restrictions. Successful exploitation results in arbitrary code execution as the web server user.

Affected products

WWBN AVideo <= 29.0

Identifiers

CVE-2026-45578
GHSA-xw67-cg5f-4m2r

Timeline

2026-05-11: advisory: GitHub Security Advisory published
2026-05-29: disclosed: CVE published to NVD

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-xw67-cg5f-4m2r

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.