# CVE-2026-64625: WWBN AVideo OS command injection in execAsync

Source: https://junglewise.ai/threats/cve-2026-64625-wwbn-avideo-os-command-injection-in-execasync  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-64625 · Severity: critical · CVSS 9.8 · Published 2026-07-20

AVideo, an open-source video platform, is vulnerable to a security flaw that allows attackers to take complete control of the server. This occurs because the software fails to properly clean user-provided data before passing it to the underlying operating system. An attacker can exploit this to run unauthorized commands, potentially leading to data theft, service disruption, or full system compromise.

Technologies: [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-64625 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64625 being exploited in the wild.

**How severe is CVE-2026-64625?** Critical severity, with a CVSS score of 9.8, published 20 July 2026.

**Which products and versions are affected?** WWBN AVideo < 29.0.

**Is there a fix for CVE-2026-64625?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-64625 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-64625?** Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

AVideo suffers from an OS command injection vulnerability due to an incomplete fix for CVE-2026-45578. While the application uses escapeshellarg() to sanitize individual tokens, the execAsync() helper function in objects/functionsExec.php re-wraps the assembled command string in a double-quoted 'sh -c' wrapper. Because the function only uses addcslashes() to escape double quotes, it fails to neutralize shell metacharacters like $() and backticks. A remote, unauthenticated attacker can exploit this via the Live plugin's on_publish.php endpoint to achieve arbitrary code execution. The issue is resolved in version 29.0 by improving the command execution helper.

## Affected products

- WWBN AVideo < 29.0

## Timeline

- 2026-07-07: advisory: Initial GitHub security advisory published
- 2026-07-20: disclosed: NVD publication date

## References

- [https://github.com/WWBN/AVideo/security/advisories/GHSA-rc5x-vh5v-473f](https://github.com/WWBN/AVideo/security/advisories/GHSA-rc5x-vh5v-473f)
- [https://www.vulncheck.com/advisories/avideo-before-os-command-injection-via-execasync](https://www.vulncheck.com/advisories/avideo-before-os-command-injection-via-execasync)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)