High severity8.1NVD Advisory· Published Jul 16, 2026· Updated Jul 20, 2026

CVE-2026-63305

Description

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into these fields to execute OS commands as the web-server user.

Affected products

WWBN/Avideollm-fuzzy
Range: <=29.0

Patches

Vulnerability mechanics

References

github.com/WWBN/AVideo/security/advisories/GHSA-g9x9-q7qj-6mv5nvd
www.vulncheck.com/advisories/avideo-through-os-command-injection-via-ffmpeg-json-phpnvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000