What is the CVSS score of CVE-2026-41064?

CVE-2026-41064 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WWBN AVideo are affected by CVE-2026-41064?

WWBN AVideo versions up to 29.0 contain a critical unauthenticated remote code execution vulnerability in test.php that allows attackers to execute arbitrary system commands through malformed URL…

How to fix or mitigate CVE-2026-41064?

Within 24 hours: Identify all WWBN AVideo deployments and confirm versions ≤29.0 in your environment; immediately restrict network access to test.php via firewall or WAF rules blocking any requests to that endpoint. Within 7 days: Monitor upstream WWBN AVideo releases for a patched version incorporating commit 78bccae; test and deploy patched version as soon as available. Within 30 days: Complete migration to patched release; verify exploitation attempts in logs; conduct post-incident review if any suspicious test.php access occurred.

WWBN AVideo CVE-2026-41064

CRITICAL

OS Command Injection (CWE-78)

2026-04-21 GitHub_M

GHSA-pq8p-wc4f-vg7j

PHP Command Injection

9.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 19:22 vuln.today

cvss_changed

Analysis Generated

Apr 22, 2026 - 00:57 vuln.today

Analysis Generated

Apr 21, 2026 - 23:31 vuln.today

CVE Published

Apr 21, 2026 - 23:04 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's test.php adds escapeshellarg for wget but leaves the file_get_contents and curl code paths unsanitized, and the URL validation regex /^http/ accepts strings like httpevil[.]com. Commit 78bccae74634ead68aa6528d631c9ec4fd7aa536 contains an updated fix.

AnalysisAI

Remote code execution in WWBN AVideo up to version 29.0 allows unauthenticated attackers to execute arbitrary system commands via unsanitized URL parameters in test.php. This vulnerability stems from an incomplete fix that sanitized wget calls but left file_get_contents and curl code paths exploitable through regex bypass (accepting strings like 'httpevil[.]com'). CVSS 9.3 with Critical scope change reflects the severity. Upstream fix available in commit 78bccae but no tagged release version confirmed at time of analysis. EPSS data not provided; no CISA KEV listing identified.

Technical ContextAI

AVideo's test.php file performs URL fetching operations using multiple PHP functions (wget via shell execution, file_get_contents, and curl). The vulnerability arises from CWE-78 OS Command Injection where user-supplied URLs pass through an insufficient validation regex (/^http/) that only checks if the string starts with 'http', enabling bypass with malicious domains like 'httpevil[.]com'. While an earlier patch applied escapeshellarg to the wget code path, the parallel file_get_contents and curl implementations remained unsanitized, allowing attackers to inject shell metacharacters or malicious URLs that get executed in system context. The CVSS scope change (S:C) indicates the vulnerable component can affect resources beyond its security scope, suggesting the test.php utility runs with elevated privileges or broader system access than typical web application endpoints.

RemediationAI

Primary fix: Apply commit 78bccae74634ead68aa6528d631c9ec4fd7aa536 from https://github.com/WWBN/AVideo/commit/78bccae74634ead68aa6528d631c9ec4fd7aa536. Note that no tagged release version containing this fix has been independently confirmed - organizations must verify the commit is present in their deployment. Immediate compensating control: Delete or restrict access to test.php in production environments via web server configuration (e.g., deny access in nginx/Apache rules or remove the file entirely), as this appears to be a diagnostic utility not required for normal operation. Trade-off: Removing test.php may disable troubleshooting functionality, but this is acceptable given the RCE risk. If test.php must remain accessible, implement IP allowlisting to restrict access to trusted administrator networks only, though this carries operational overhead and misconfiguration risk. Review web application firewall rules to block requests containing shell metacharacters in URL parameters as defense-in-depth, acknowledging this may cause false positives. Consult GitHub advisories at https://github.com/WWBN/AVideo/security/advisories/GHSA-pq8p-wc4f-vg7j for vendor guidance.