CVE-2026-63304
AVideo version 29.0 has a critical flaw that lets attackers run any operating‑system command on the server. The vulnerability is in a plugin file that fails to escape user‑supplied input, allowing a crafted request to break out of a quoted context. It can be exploited by anyone who can send a specially encoded payload to the affected endpoint.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
AVideo 29.0, specifically the plugin/API/standAlone/functions.php file that contains the listFFmpegProcesses() function.
Real-world impact
An attacker who can send a valid encrypted payload can execute arbitrary commands on the web‑server as the user running the web service, potentially taking full control of the server, stealing data, or installing malware.
Why this severity
The CVSS score of 9.2 reflects the high impact of the vulnerability: it allows remote attackers to execute commands with the privileges of the web server, has no authentication or user interaction required, and can be used to compromise the entire system.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 16, 2026 · 17d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.