Unauthenticated OS Command Injection in AVideo via `base64Url` Parameter
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 8, 2026
A critical, zero-click unauthenticated OS command injection vulnerability was disclosed in the open-source video hosting/streaming platform AVideo, tracked as CVE-2026-29058. The flaw affects versions prior to 7.0 (including 6.0) and allows remote attackers to execute arbitrary operating system commands on the server without user interaction or prior privileges, creating a path to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption.
The issue stems from objects/getImage.php, where attacker-controlled input in the base64Url GET parameter is Base64-decoded and incorporated into a double-quoted ffmpeg shell command without proper escaping/neutralization of shell metacharacters and command substitution (CWE-78). The vulnerability was reported by security researcher Arkmarta, and remediation is available by upgrading to AVideo 7.0 or later, which includes the official patch.
