What is the CVSS score of CVE-2026-29058?

CVE-2026-29058 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-29058?

Yes, a public proof-of-concept exploit is available for CVE-2026-29058. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-29058?

Within 24 hours: Identify all AVideo deployments and their versions; immediately isolate affected instances from production networks if pre-7.0; enable emergency WAF rules to block base64Url parameter exploitation. Within 7 days: Deploy network segmentation to restrict AVideo server access; implement aggressive input validation and request filtering; conduct forensic analysis for signs of compromise. Within 30 days: Upgrade to AVideo 7.0 or later when available; perform security assessment of compromised systems; review and rotate all credentials and API keys on affected infrastructure.

Avideo Encoder CVE-2026-29058

CRITICAL

OS Command Injection (CWE-78)

2026-03-06 security-advisories@github.com

GHSA-9j26-99jh-v26q

Command Injection Avideo Encoder Wwbn

9.8

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send HTTP GET request with malicious base64Url parameter
Exploit

Inject shell command substitution syntax
Execution

Execute arbitrary OS commands as server process
Impact

Achieve full system compromise

Vulnerability Assessment

Weakness	CWE CWE-78 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization OS command sanitization, avoid shell exec MITRE ATT&CK 2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	AVideo versions prior to 7.0 with unauthenticated access to the application accepting GET requests with base64Url parameter. No authentication required; default deployment vulnerable.
Impact	CVSS 9.8.
Exploit ScenarioDerived	Inject OS commands.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Unauthenticated OS command injection in AVideo before 7.0.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:06 CVSS 9.8

Unauthenticated RCE in AVideo.

RemediationAI

Update.

Affected Packages

composer wwbn/avideo fix: 7.0.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in composer

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-78.

Know when Avideo Encoder gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 06, 2026 - 07:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption. This issue has been patched in version 7.0.

Executive ViewAI

Why It Matters

AVideo installations prior to version 7.0 are vulnerable to unauthenticated remote code execution with critical severity (CVSS 9.8), allowing attackers to take complete control of affected servers without credentials. Any organization running AVideo must assume compromise is possible and take immediate action, as no vendor patch currently exists and exploitation requires minimal technical sophistication.

Business Impact: Severe

Compensating Controls

Implement WAF rules blocking shell metacharacters (backticks, $(), semicolons, pipes) in base64Url parameter; disable or restrict access to the affected parameter at network perimeter; segment AVideo servers from critical assets and databases; apply strict input validation rejecting non-alphanumeric base64 characters; monitor for suspicious process execution and outbound connections from AVideo servers; consider temporary service shutdown until patched version is available.

Threat Intelligence Overview

EPSS Score

0.1%

Top 71% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS POC (2)

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat Yes

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.