Which versions of AVideo are affected by CVE-2026-64625?

AVideo installations running versions before 29.0 are vulnerable to unauthenticated remote code execution through the Live plugin, allowing attackers to execute arbitrary commands on video publishing…. A patch is available.

How to fix or mitigate CVE-2026-64625?

Within 24 hours, inventory all AVideo deployments and isolate any exposed instances from untrusted networks; block external access to the Live plugin's on_publish.php endpoint at network perimeter or firewall. Within 7 days, implement Web Application Firewall (WAF) rules to block shell metacharacters ($, `, |, ;, &, >, <, (, )) in on_publish.php parameters and enable centralized logging of all requests to this endpoint; restrict access to internal networks only if operationally feasible. Within 30 days, monitor vendor advisories for AVideo 29.0 or later patch availability; begin planning upgrade procedures now to enable rapid deployment upon patch release.

AVideo CVE-2026-64625

Q: What is the CVSS score of CVE-2026-64625?

CVE-2026-64625 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-46119 CRITICAL

OS Command Injection (CWE-78)

2026-07-20 disclosure@vulncheck.com

GHSA-9h6c-phqv-934p

PHP Command Injection

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated request to on_publish.php yields shell command execution with no interaction, giving full C/I/A impact; scope unchanged as commands run within the host service context.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 21, 2026 - 02:02 EUVD

Analysis Generated

Jul 20, 2026 - 22:33 vuln.today

CVE Published

Jul 20, 2026 - 22:17 cve.org

CRITICAL 9.3

DescriptionCVE.org

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.

Articles & Coverage 1

News Critical OS Command Injection in AVideo PHP Live Plugin - CVE-2026-64625 Jul 21, 2026

AnalysisAI

OS command injection in AVideo before version 29.0 allows remote attackers to execute arbitrary commands via the Live plugin's on_publish.php endpoint. The flaw is an incomplete fix for CVE-2026-45578: the execAsync() helper re-wraps already-escaped input inside a double-quoted 'sh -c' invocation, which lets shell command substitution using $() or backticks bypass the escapeshellarg() sanitization entirely. There is no public exploit identified at time of analysis, but the network, no-privilege, no-interaction vector (CVSS 4.0 base 9.3) makes this a high-priority patch for exposed AVideo installations.

Technical ContextAI

AVideo (developed by WWBN) is an open-source PHP-based video streaming and live-broadcast platform. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). AVideo attempts to sanitize shell arguments with PHP's escapeshellarg(), which safely single-quotes untrusted input. However, the execAsync() wrapper then re-embeds that escaped string inside a new command that is executed via a double-quoted 'sh -c "..."'. Because double quotes in POSIX shells still permit command substitution, sequences like $(...) and ... are evaluated by the shell before the escaped literal protection applies, nullifying escapeshellarg(). The Live plugin exposes on_publish.php as the injection sink, an endpoint typically invoked as an RTMP publish callback.

RemediationAI

Upgrade to AVideo 29.0 or later, which contains the complete fix; the version-based advisory ('before 29.0') indicates 29.0 is the first fixed release, though the exact patched build should be confirmed against GHSA-rc5x-vh5v-473f (https://github.com/WWBN/AVideo/security/advisories/GHSA-rc5x-vh5v-473f) and the VulnCheck advisory (https://www.vulncheck.com/advisories/avideo-before-os-command-injection-via-execasync). Because a prior patch for CVE-2026-45578 is insufficient, do not rely on it. If immediate upgrade is not possible, disable the Live plugin to remove the vulnerable on_publish.php code path (trade-off: live-streaming functionality is lost), and restrict network access to the on_publish.php endpoint so it is reachable only from the trusted RTMP/media server rather than the public internet (trade-off: requires correct firewall/reverse-proxy ACLs and may break legitimate publish callbacks if misconfigured).