CVE-2026-29058

AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption. This issue has been patched in version 7.0.

Affected

WWBN · AVideo-Encoder

CVSS v3.1 GITHUB

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

6.77% chance of exploitation in the next 30 days, 94th percentile

Nuclei

critical · CWE-78

Published

2026-03-06

Updated

2026-03-09

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29058.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/avideo_encoder_getima…

Security advisories

• WWBN/AVideo-Encoder/security/advisories/GHSA-9j26-99jh-v26q
• advisories/GHSA-9j26-99jh-v26q

References

• CVE Record
• NVD entry