CVE-2026-63305

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0

Description An OS command injection issue exists in the 'ffmpeg.json.php' endpoint. The notifyCode and callback parameters are concatenated into a shell command without proper escaping. An attacker capable of crafting a valid encrypted payload can inject shell metacharacters into these fields to execute arbitrary operating system commands with the privileges of the web-server user.

Recommendations Update to a version newer than 29.0. As a temporary mitigation, restrict access to the 'ffmpeg.json.php' endpoint or avoid using the notifyCode and callback parameters.