high8.1
CVE-2026-63305
AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated in…
Impact
AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into these fields to execute OS commands as the web-server user.
Affected products
| Product | Affected versions |
|---|---|
| AVideo | through 29.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.