WWBN AVideo CVE-2026-41064

Exploitation requires the test.php file to be present and accessible via HTTP/HTTPS on the target AVideo installation. Default AVideo deployments through version 29.0 include this file, but production hardening guides may recommend its removal. The vulnerable code paths (file_get_contents and curl) are triggered when the application processes URL parameters without proper sanitization - no special feature toggles or non-default configurations required beyond test.php being web-accessible. Attack succeeds against default installations of AVideo ≤29.0 where test.php was not manually removed. Limiting factor: If test.php has been deleted during production deployment or access is restricted via web server ACLs, the vulnerability cannot be exploited despite the underlying code flaw remaining present.

This represents a critical-severity remote code execution vector requiring immediate attention. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms trivial exploitation: network-accessible, low complexity, no authentication, no user interaction required. The scope change to 'Changed' elevates this beyond typical RCE, indicating potential container escape or cross-boundary impact. However, risk contextualization depends on test.php's presence in production deployments - if this is a development/diagnostic file not intended for production, actual exposure may be limited to misconfigured installations. No public exploit code confirmed in provided references, and absence from CISA KEV suggests targeted rather than widespread exploitation. Critical gap: the fix exists only as a GitHub commit (78bccae) without confirmation of a tagged release version, meaning even patched installations may be difficult to verify. Organizations running AVideo ≤29.0 with test.php accessible face immediate remote compromise risk.

An unauthenticated remote attacker crafts a malicious HTTP request to AVideo's test.php endpoint with a URL parameter containing a domain like 'httpevil[.]com`; malicious_command #' that bypasses the /^http/ validation regex. When test.php processes this through the unsanitized file_get_contents or curl code path, the injected command executes with the privileges of the web server process, granting the attacker arbitrary code execution. The attacker could establish persistence, exfiltrate video content or user data (C:H), or modify application behavior (I:L). No public proof-of-concept code confirmed in provided references, but the technical details in the advisories provide sufficient information for skilled attackers to develop exploits.