{"id":"CVE-2026-29058","aliases":["GHSA-9j26-99jh-v26q"],"url":"https://o3.security/vulnerability/CVE-2026-29058","summary":"AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php","details":"## Impact\n\nAn unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the `base64Url` GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption.\n\n## Root Cause\n\nThe `base64Url` parameter is Base64-decoded and then interpolated directly into a double-quoted `ffmpeg` shell command without proper shell escaping. The upstream validation uses `FILTER_VALIDATE_URL`, which validates URL syntax but does not prevent shell metacharacters / command substitution sequences from being interpreted by the shell.\n\n## Affected Components\n\n* `objects/getImage.php`\n* `objects/security.php`\n* Execution path via async command execution helper (`shell_exec`/`nohup`)\n\n## Patches\n\nApply strict shell argument escaping (e.g., `escapeshellarg()`) to all user-supplied values before building any shell command, and avoid double-quoted interpolation of untrusted input. Prefer safer process execution patterns where possible.\n\n## Workarounds\n\n* Restrict access to `objects/getImage.php` at the web server / reverse proxy layer (IP allowlist, auth, or disable endpoint if not needed).\n* Apply WAF rules to block suspicious patterns and limit exposure until a patch is deployed.\n\n## Resources\n\n* Report: \"Unauthenticated OS Command Injection in AVideo-Encoder\"","published":"2026-03-06T07:08:26.844Z","modified":"2026-08-12T03:51:31.331763434Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.02132,"percentile":0.80169,"asOf":"2026-08-04"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"wwbn/avideo","fixedVersion":"7.0.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29058.json"},{"type":"ADVISORY","url":"https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-9j26-99jh-v26q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29058"},{"type":"PACKAGE","url":"https://github.com/WWBN/AVideo-Encoder"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:31.331763434Z"}}