CVE-2026-63304

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1

Description An OS command injection issue exists in the plugin/API/standAlone/functions.php file. The listFFmpegProcesses() function interpolates unsanitized keyword parameters within single quotes without proper escaping. An attacker can provide a specially crafted encrypted codeToExec payload to break out of the single-quoted grep context, allowing the execution of arbitrary operating system commands with the privileges of the web-server user.

Recommendations Update AVideo to a version later than 29.0. As a temporary mitigation, restrict access to the listFFmpegProcesses() function.