How to fix or mitigate CVE-2026-63305?

Within 24 hours: inventory all WWBN AVideo deployments and identify instances running version 29.0 or earlier; map network accessibility of the ffmpeg.json.php endpoint. Within 7 days: contact WWBN to confirm patch availability and test any patched version in staging; concurrently implement WAF rules to block or restrict access to the ffmpeg.json.php endpoint to trusted internal networks only, and disable the endpoint if not operationally required. Within 30 days: complete deployment of either patched version or finalized compensating controls; establish baseline monitoring and alerting for anomalous requests to the ffmpeg.json.php endpoint and related application errors.

AVideo CVE-2026-63305

Q: What is the CVSS score of CVE-2026-63305?

CVE-2026-63305 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

EUVD-2026-44914 CRITICAL

OS Command Injection (CWE-78)

2026-07-16 VulnCheck

GHSA-jrxj-9mhw-55wc

PHP Command Injection Avideo Wwbn

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable with no auth or UI (PR:N/UI:N), but forging a valid encrypted payload raises complexity to AC:H; unescaped shell exec yields full C:H/I:H/A:H on the host.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 13:21 vuln.today

CVE Published

Jul 16, 2026 - 12:19 cve.org

CRITICAL 9.2

DescriptionCVE.org

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into these fields to execute OS commands as the web-server user.

Articles & Coverage 1

News Critical OS Command Injection in WWBN AVideo ≤29.0 - CVE-2026-63305 Jul 17, 2026

AnalysisAI

OS command injection in WWBN AVideo through version 29.0 allows attackers to execute arbitrary operating-system commands as the web-server user via the ffmpeg.json.php endpoint. The notifyCode and callback request parameters are concatenated into a shell command without escaping, so an attacker able to produce a valid encrypted payload can inject shell metacharacters and achieve remote code execution. No public exploit identified at time of analysis; the flaw carries a CVSS 4.0 base score of 9.2, though successful exploitation is gated by the requirement to forge a valid encrypted payload.

Technical ContextAI

AVideo is an open-source PHP-based video streaming and encoding platform (vendor wwbn, per CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) that shells out to the ffmpeg media toolchain for transcoding and notification callbacks. The vulnerable ffmpeg.json.php endpoint builds a shell command line by string-concatenating the user-supplied notifyCode and callback parameters directly, without applying escapeshellarg/escapeshellcmd or equivalent quoting. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) root cause: because the values reach a shell interpreter unsanitized, metacharacters such as ;, |, &&, backticks, or $() break out of the intended ffmpeg invocation and are executed by the underlying OS with the privileges of the PHP/web-server process.

RemediationAI

Patch available per vendor advisory GHSA-g9x9-q7qj-6mv5 (https://github.com/WWBN/AVideo/security/advisories/GHSA-g9x9-q7qj-6mv5); upgrade to the fixed release referenced there, as an exact fixed version is not stated in the available data - confirm the target version directly from the advisory and the AVideo GitHub releases before deploying. Until patched, restrict network access to the ffmpeg.json.php endpoint (for example via web-server location rules or a WAF blocking requests to that path), noting this will break legitimate ffmpeg notification callbacks that traverse that endpoint, so validate encoding/notification workflows afterward. As additional hardening, run the PHP/web-server process under a low-privilege, sandboxed account and consider disabling unnecessary shell-exec PHP functions where AVideo does not require them to limit blast radius, accepting that this may break transcoding features that legitimately invoke ffmpeg. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/avideo-through-os-command-injection-via-ffmpeg-json-php) for further detail.