AVideo Command Injection Flaw Exposed

A severe security vulnerability has been identified within AVideo, affecting all versions prior to 29.0. The flaw stems from an incomplete resolution to a prior issue, CVE-2026-45578, which failed to fully neutralize risks associated with how the software processes command execution.

Flawed Command Processing Logic

The issue resides in the execAsync() function, which handles command execution for the platform. Despite the application of escapeshellarg() protections intended to sanitize inputs, the function improperly re-wraps escaped commands within double-quoted sh -c strings. This implementation error leaves the system vulnerable to command substitution attacks, specifically those utilizing backticks or the $() syntax.

Plugin Endpoint Exposure

The primary vector for exploiting this vulnerability is the on_publish.php endpoint, which is part of the platform's Live plugin. By leveraging this endpoint, an attacker can bypass existing safety measures to inject arbitrary commands directly into the underlying operating system. The nature of this flaw allows for unauthorized interactions at a level that could impact system integrity and availability.

Vulnerability Impact Metrics

• CVE-2026-64625 is the identifier for this specific vulnerability.
• The CVSS 3.1 score for this flaw is 9.8, classifying it as CRITICAL.
• The vulnerability was formally published on 2026-07-20T22:17:18.740.

Operational Security Considerations

For administrators and organizations relying on the AVideo platform, the existence of this command injection vulnerability suggests significant risks to the host environment. The technical implementation of the execAsync() function allows for an attacker to influence the execution context of the server without needing specialized privileges. Because the flaw permits arbitrary command execution through the on_publish.php file, the integrity of the host server depends on the deployment of version 29.0 or later to close the identified security gap.