CVE-2026-63305
AVideo 29.0 has a critical flaw that lets attackers run any command on the server. The vulnerability is in the ffmpeg.json.php endpoint, where user-supplied data is inserted into a shell command without proper escaping. If exploited, the attacker can gain the same privileges as the web-server process.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
AVideo 29.0 (the open-source video platform).
Real-world impact
An attacker who can send a specially crafted request can execute arbitrary shell commands on the server, potentially taking full control of the host.
Why this severity
The CVSS score of 9.2 reflects that the flaw can be triggered remotely over the network, requires no special privileges, and allows the attacker to run commands with the web-server’s rights. The high impact on confidentiality, integrity, and availability, combined with the low effort needed to exploit, pushes the score into the critical range.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 16, 2026 · 17d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.