CVE-2026-41064

Published: Apr 22, 2026Modified: Jun 17, 2026

9.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.7

Source: security-advisories@github.com (Secondary)

Description

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget but leaves the `file_get_contents` and `curl` code paths unsanitized, and the URL validation regex `/^http/` accepts strings like `httpevil[.]com`. Commit 78bccae74634ead68aa6528d631c9ec4fd7aa536 contains an updated fix.

Affected (1)

Products: Wwbn: Avideo

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wwbn Avideo	Up to 29.0

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (5)

https://github.com/WWBN/AVideo/commit/1e6cf03e93b5a5318204b010ea28440b0d9a5ab3

Source: security-advisories@github.com

Patch

https://github.com/WWBN/AVideo/commit/78bccae74634ead68aa6528d631c9ec4fd7aa536

Source: security-advisories@github.com

Patch

https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

https://github.com/WWBN/AVideo/security/advisories/GHSA-pq8p-wc4f-vg7j

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationVendor Advisory

Timeline

No history available yet.