CVE-2026-64625 — AVideo before 29.0 OS Command Injection via execAsync
AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and ba…
Published: 2026-07-20 · CVSS: 9.3 · CVSS 4.0
AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7