WWBN AVideo CVE-2026-41064
CRITICAL
GHSA-pq8p-wc4f-vg7j
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionNVD
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's test.php adds escapeshellarg for wget but leaves the file_get_contents and curl code paths unsanitized, and the URL validation regex /^http/ accepts strings like httpevil[.]com. Commit 78bccae74634ead68aa6528d631c9ec4fd7aa536 contains an updated fix.
AnalysisAI
Remote code execution in WWBN AVideo up to version 29.0 allows unauthenticated attackers to execute arbitrary system commands via unsanitized URL parameters in test.php. This vulnerability stems from an incomplete fix that sanitized wget calls but left file_get_contents and curl code paths exploitable through regex bypass (accepting strings like 'httpevil[.]com'). …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all WWBN AVideo deployments and confirm versions ≤29.0 in your environment; immediately restrict network access to test.php via firewall or WAF rules blocking any requests to that endpoint. Within 7 days: Monitor upstream WWBN AVideo releases for a patched version incorporating commit 78bccae; test and deploy patched version as soon as available. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today