Executive brief
AVideo, an open-source video platform, is vulnerable to a security flaw that allows attackers to take complete control of the server. This occurs because the software fails to properly clean user-provided data before passing it to the underlying operating system. An attacker can exploit this to run unauthorized commands, potentially leading to data theft, service disruption, or full system compromise.
Technical details
AVideo suffers from an OS command injection vulnerability due to an incomplete fix for CVE-2026-45578. While the application uses escapeshellarg() to sanitize individual tokens, the execAsync() helper function in objects/functionsExec.php re-wraps the assembled command string in a double-quoted 'sh -c' wrapper. Because the function only uses addcslashes() to escape double quotes, it fails to neutralize shell metacharacters like $() and backticks. A remote, unauthenticated attacker can exploit this via the Live plugin's on_publish.php endpoint to achieve arbitrary code execution. The issue is resolved in version 29.0 by improving the command execution helper.
Affected products
- WWBN AVideo < 29.0
Timeline
- 2026-07-07: advisory: Initial GitHub security advisory published
- 2026-07-20: disclosed: NVD publication date