Which versions of AVideo are affected by CVE-2026-63304?

AVideo (WWBN) versions through 29.0 contain a critical unauthenticated remote code execution vulnerability in the standAlone plugin that allows attackers to execute arbitrary operating system…

How to fix or mitigate CVE-2026-63304?

Within 24 hours: Identify all systems running AVideo through version 29.0 and assess whether the standAlone plugin is actively used. Immediately disable the standAlone plugin if not business-critical to reduce attack surface. Within 7 days: Implement compensating controls including network-level access restrictions to the standAlone API endpoints, deploy Web Application Firewall rules to detect suspicious encrypted payloads, and establish enhanced monitoring for exploitation attempts against the listFFmpegProcesses() function. Within 30 days: Contact WWBN to verify availability of patched versions beyond 29.0, or plan and execute migration to an alternative media management platform if no patched release is available.

AVideo CVE-2026-63304

Q: What is the CVSS score of CVE-2026-63304?

CVE-2026-63304 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

EUVD-2026-44913 CRITICAL

OS Command Injection (CWE-78)

2026-07-16 VulnCheck

GHSA-jjpq-qx77-qjwj

PHP Command Injection Avideo Wwbn

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N) but requires forging a valid encrypted payload, so AC:H; command execution as web user gives full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 13:22 vuln.today

CVE Published

Jul 16, 2026 - 12:19 cve.org

CRITICAL 9.2

DescriptionCVE.org

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses() function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can break out of the single-quoted grep context and execute arbitrary OS commands as the web-server user.

Articles & Coverage 1

News Critical OS Command Injection in AVideo (WWBN) through v29.0 - CVE-2026-63304 Jul 17, 2026

AnalysisAI

OS command injection in AVideo (WWBN) through version 29.0 lets remote attackers who can forge a valid encrypted codeToExec payload run arbitrary shell commands as the web-server user via the listFFmpegProcesses() function in the standAlone plugin API. The flaw is unauthenticated (PR:N) but non-trivial to reach because it depends on producing an accepted encrypted parameter, and no public exploit or CISA KEV listing is identified at time of analysis.

Technical ContextAI

AVideo is an open-source PHP video-streaming and content-management platform that shells out to FFmpeg for media processing. The vulnerable code path is plugin/API/standAlone/functions.php, where listFFmpegProcesses() builds a shell command (a grep over running FFmpeg processes) by interpolating a caller-supplied keyword directly inside a single-quoted string without escaping. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) issue: because the keyword is placed inside single quotes but not sanitized, an attacker can supply a single quote to close the quoted context and append shell metacharacters. The affected component is identified by cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*, covering AVideo builds up to and including 29.0.

RemediationAI

Patch available per vendor advisory: consult the AVideo GitHub Security Advisory GHSA-j44m-77cc-p3cc (https://github.com/WWBN/AVideo/security/advisories/GHSA-j44m-77cc-p3cc) and upgrade to the fixed release it designates; a released patched version could not be independently confirmed from the provided data, so verify the fixed tag against the advisory before deploying. Until patched, restrict network access to the standAlone plugin API endpoints (block or firewall external requests to plugin/API/standAlone) so the codeToExec entry point is not reachable from untrusted networks, and disable the standAlone API plugin if it is not required - the trade-off is loss of the standalone/FFmpeg process-listing functionality it provides. As a hardening measure, run the web-server/PHP process under a least-privilege account so a successful injection yields minimal OS reach, and monitor for anomalous FFmpeg/grep child processes. Corroborate details against the VulnCheck advisory at https://www.vulncheck.com/advisories/avideo-through-os-command-injection-via-listffmpegprocesses.