A critical command injection flaw in WWBN AVideo lets unauthenticated attackers run arbitrary OS commands through the Live plugin, stemming from an incomplete fix for an earlier vulnerability.
What Is It
CVE-2026-64625 is an OS command injection vulnerability (CWE-78) in WWBN AVideo before version 29.0. It is an incomplete fix for CVE-2026-45578: the execAsync() function re-wraps escaped commands in a double-quoted sh -c, which allows command substitution via $() and backticks. As a result, attackers can inject arbitrary OS commands through the Live plugin's on_publish.php endpoint despite the escapeshellarg() protection that was supposed to sanitize input.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL), with a CVSS 4.0 score of 9.3. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N), and needs no user interaction (UI:N). Successful exploitation yields high impact to confidentiality, integrity, and availability; effectively full compromise of the affected server via arbitrary command execution.
What's Vulnerable
- Vendor: WWBN
- Product: AVideo
- Affected versions: All versions before 29.0 (versions
0up to, but not including,29.0)
The vulnerable code path is the execAsync() function reached through the Live plugin on_publish.php endpoint.
Patch Status
The supplied source material does not include a CISA KEV entry, so there is no confirmation of active exploitation in the provided data. The fix is available in AVideo version 29.0; upgrading to 29.0 or later remediates the issue. Because this is an incomplete fix for CVE-2026-45578, prior partial patches are insufficient.