CVE-2026-63305

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-63305

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63305.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-63305

Aliases

GHSA-g9x9-q7qj-6mv5

Published

2026-07-16T12:19:16Z

Modified

2026-08-12T03:51:08Z

Severity

9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

AVideo through 29.0 OS Command Injection via ffmpeg.json.php

Details

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into these fields to execute OS commands as the web-server user.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63305.json"
}

References

Affected packages

Git / github.com/wwbn/avideo

Affected ranges

Type

GIT

Repo

https://github.com/wwbn/avideo

Events

Introduced

Fixed

2386f39caea1d2ef36267b252fa76af283294623

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "29.0"
        },
        {
            "fixed": "29.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

10.*

10.8

Other

11.*

11.1

11.1.1

11.5

11.6

12.*

12.4

14.*

14.3

14.3.1

18.*

18.0

2.*

2.2

2.7

21.*

21.0

22.*

22.0

24.*

24.0

25.*

25.0

26.*

26.0

3.*

3.4

4.*

4.0

7.*

7.2

7.3

7.4

7.6

7.7

7.8

8.*

8.1

8.5

8.6

8.7

8.9

8.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63305.json"