CVE-2026-29058
CRITICAL
GHSA-9j26-99jh-v26q
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption. This issue has been patched in version 7.0.
Analysis
Unauthenticated OS command injection in AVideo before 7.0.
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all AVideo deployments and their versions; immediately isolate affected instances from production networks if pre-7.0; enable emergency WAF rules to block base64Url parameter exploitation. Within 7 days: Deploy network segmentation to restrict AVideo server access; implement aggressive input validation and request filtering; conduct forensic analysis for signs of compromise. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today