SEPTEMBER 7, 2026
Live Feed
Back to database
Case File

CVE-2026-64625

CRITICAL · CVSS 9.8 EPSS 0.35% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-20 · Last synced 2026-08-19

CyberRota Analysis

AI-Generated

AVideo versions prior to 29.0 are vulnerable due to an incomplete fix that allows attackers to inject arbitrary OS commands through the Live plugin's on_publish.php endpoint, bypassing existing protections. This critical vulnerability, with a CVSS score of 9.8, can lead to severe system compromise. Organizations using AVideo should prioritize patching to mitigate the risk of command injection attacks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-64625
Severity
CRITICAL
CVSS
9.8
EPSS
0.35%

Original NVD Description

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.