critical9.8
CVE-2026-64625
AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitut…
Impact
AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.
Affected products
| Product | Affected versions |
|---|---|
| AVideo | before 29.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.