Critical Command Injection Flaw in AVideo

AVideo software versions prior to 29.0 are affected by a critical command injection vulnerability tracked as CVE-2026-64625. This flaw stems from an incomplete fix for a previous security issue, leaving the on_publish.php endpoint in the Live plugin exposed to malicious input that bypasses existing security filters.

What's at Risk

The vulnerability affects all AVideo installations running versions earlier than 29.0. Because the flaw exists within the Live plugin, any internet-facing deployment of the software is at significant risk. Organizations utilizing AVideo to host or manage video content should consider their instances compromised if left unpatched, as the vulnerability allows for full system access without requiring authentication.

Systems that are exposed to the public internet are at the highest risk, as the attack vector does not require a user account or prior interaction with the application. This puts any server running the affected software in a position where an external actor can gain control over the underlying operating system.

How the Flaw Works

This vulnerability is a form of OS command injection. In general terms, this class of weakness occurs when an application passes unsafe user-supplied data to a system shell. When an application fails to properly sanitize or escape this input, an attacker can append their own commands to the intended operation.

In this specific case, the application attempts to wrap commands in double quotes, but fails to account for command substitution characters like backticks or the dollar-sign-parenthesis syntax. When these characters are processed by the shell, the system executes the attacker's injected code with the same privileges as the web server process. This typically allows an attacker to read sensitive files, modify data, or install persistent backdoors on the host server.

How to Protect Your Systems

• Upgrade your AVideo installation to version 29.0 or higher immediately to apply the vendor-supplied fix.
• Restrict access to the on_publish.php endpoint at the web server or firewall level if an immediate upgrade is not possible.
• Follow the principle of least privilege by running the web service under a dedicated, low-privilege user account to limit the impact of a potential compromise.
• Implement network segmentation to isolate the video hosting server from the rest of your internal infrastructure.
• Monitor server logs for unusual execution patterns or unexpected calls to system binaries originating from the web application.

With a CVSS score of 9.8, this vulnerability represents a severe threat to infrastructure security. Given that the flaw allows for full remote code execution, prompt patching is the only effective way to mitigate the risk of unauthorized system access and potential data loss.