CVE-2026-29058

CRITICAL

AVideo < 7.0 - Unauthenticated OS Command Injection via base64Url GET Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-29058. PoCs published by arkmarta, including Metasploit module exploits/linux/http/avideo_encoder_getimage_cmd_injection.

AI-analyzed exploit summary This Metasploit module exploits an unauthenticated command injection vulnerability in AVideo Encoder's getImage.php endpoint (CVE-2026-29058) by injecting arbitrary commands via the base64Url parameter, which is decoded and passed unsanitized to an ffmpeg shell command.

Description

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption. This issue has been patched in version 7.0.

Exploits (1)

metasploit WORKING POC EXCELLENT

by arkmarta · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb

View Code ZIP pw:eip

This Metasploit module exploits an unauthenticated command injection vulnerability in AVideo Encoder's getImage.php endpoint (CVE-2026-29058) by injecting arbitrary commands via the base64Url parameter, which is decoded and passed unsanitized to an ffmpeg shell command.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: AVideo Encoder (versions before 7.0)

No auth needed

Prerequisites: Network access to the target's getImage.php endpoint

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Mar 19, 2026 Full analysis →

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-9j26-99jh-v26q

Scores

CVSS v3 9.8

EPSS 0.5178

EPSS Percentile 98.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-78

Status published

Products (2)

wwbn/avideo 0 - 7.0.0Packagist

wwbn/avideo-encoder < 7.0

Published Mar 06, 2026

Tracked Since Mar 06, 2026