AVideo EUVD-2026-44914

Exploitation requires the attacker to craft a VALID ENCRYPTED PAYLOAD accepted by the ffmpeg.json.php endpoint, then embed shell metacharacters (e.g. ;, |, backticks, $()) into the notifyCode and/or callback parameters, which AVideo concatenates into an ffmpeg shell command without escaping. Reachability requires network access to the ffmpeg.json.php endpoint on an AVideo instance at version 29.0 or earlier. The primary limiting factor - encoded by CVSS AC:H and AT:P - is the need to produce a cryptographically valid payload, implying knowledge of or ability to derive the application's encryption key/scheme; this is not a plug-and-play unauthenticated hit against a default install despite PR:N/UI:N. No user interaction and no application login are required once a valid payload can be generated.

The signals point to a genuinely high-severity flaw but with a meaningful exploitation barrier. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N, VC:H/VI:H/VA:H) is network-reachable and needs no authentication or user interaction, and full compromise of confidentiality, integrity, and availability of the host is possible - consistent with code execution. However, AC:H and AT:P (attack requirements present) directly encode the description's key limiter: the attacker must craft a valid encrypted payload, which is non-trivial and likely requires knowledge of, or the ability to derive, the application's encryption key/scheme. No EPSS score was provided in the input, there is no CISA KEV listing, and no public proof-of-concept is evident, so there is no signal of active or automated exploitation. Net assessment: prioritize patching because impact is total and the reporter (VulnCheck) is credible, but the payload-forging prerequisite makes opportunistic mass exploitation less likely than the 9.2 headline alone would suggest. EPSS data is missing and should be checked before final prioritization.

An attacker who has reverse-engineered or otherwise obtained the ability to produce a valid encrypted payload sends a crafted request to ffmpeg.json.php with shell metacharacters embedded in the notifyCode or callback parameter, e.g. a value containing $(...) or a semicolon-chained command. Because the parameters are concatenated into a shell command unescaped, the injected command runs as the web-server user, giving the attacker remote code execution and a host foothold. No public proof-of-concept is currently identified, and the AC:H/AT:P metrics reflect the non-trivial effort to forge the encrypted payload.