CVE-2026-63304: AVideo OS Command Injection Vulnerability

CVE-2026-63304 Overview

CVE-2026-63304 is an OS command injection vulnerability [CWE-78] in AVideo versions through 29.0. The flaw resides in the listFFmpegProcesses() function within plugin/API/standAlone/functions.php. The function interpolates unsanitized keyword parameters inside single quotes without escaping shell metacharacters. Attackers who craft a valid encrypted codeToExec payload can break out of the single-quoted grep context and execute arbitrary OS commands as the web-server user.

Critical Impact
Successful exploitation grants remote command execution as the web-server user, leading to full compromise of the AVideo host and any content or credentials stored on it.

Affected Products

AVideo (WWBN) through version 29.0
plugin/API/standAlone/functions.php component
Deployments exposing the standalone API endpoint to untrusted networks

Discovery Timeline

2026-07-16 - CVE-2026-63304 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-63304

Vulnerability Analysis

The vulnerability is a classic OS command injection [CWE-78] in the AVideo standalone API. The listFFmpegProcesses() function builds a shell command that pipes process output into grep and filters results by a caller-supplied keyword. The keyword is placed directly between single quotes in the constructed command string. No escaping or allow-list validation is applied to the keyword.

An attacker who submits a keyword containing a single quote can terminate the quoted context. The remainder of the payload is interpreted by the shell as additional commands. Because AVideo executes the command through PHP shell functions, the injected commands run under the identity of the web-server process.

The attack requires the attacker to produce a valid encrypted codeToExec payload accepted by the standalone API. This requirement raises attack complexity but does not require authentication or user interaction.

Root Cause

The root cause is unsafe string concatenation of untrusted input into a shell command. The keyword parameter reaches the command builder without sanitization, quoting, or use of a parameterized process API such as proc_open() with an argument array. Single-quote wrapping alone is insufficient because the input itself can contain a single quote.

Attack Vector

Exploitation occurs over the network against the AVideo standalone API endpoint. The attacker constructs a codeToExec payload targeting the FFmpeg process listing routine and supplies a keyword containing shell metacharacters and a closing single quote followed by an arbitrary command. When the server processes the request, the injected command executes on the host.

Refer to the GitHub Security Advisory GHSA-j44m-77cc-p3cc and the VulnCheck Security Advisory for the technical write-up.

Detection Methods for CVE-2026-63304

Indicators of Compromise

Web-server access logs containing requests to the standalone API with unusually long or encoded codeToExec parameters.
Child processes of the web-server user (www-data, apache, nginx) spawning shells such as /bin/sh, bash, curl, wget, or python.
New cron entries, SSH authorized keys, or setuid binaries created by the web-server account.
Outbound network connections from the AVideo host to unfamiliar IP addresses shortly after standalone API requests.

Detection Strategies

Alert on grep or ps command invocations from PHP-FPM or Apache workers that contain shell metacharacters (;, |, `, $() in their arguments.
Correlate HTTP requests to plugin/API/standAlone/ paths with subsequent process-creation telemetry on the same host.
Baseline expected FFmpeg process activity for AVideo and flag deviations, particularly non-FFmpeg child processes.

Monitoring Recommendations

Enable process-creation auditing (auditd, Sysmon for Linux) on servers hosting AVideo and forward events to a central analytics platform.
Monitor file integrity on plugin/API/standAlone/functions.php and the AVideo web root for unauthorized modifications.
Review web-server logs for high-volume or malformed requests targeting standalone API routes.

How to Mitigate CVE-2026-63304

Immediate Actions Required

Restrict network access to the AVideo standalone API endpoints to trusted management networks until a patched release is deployed.
Rotate any secrets, API tokens, or encryption keys used to construct codeToExec payloads if exposure to untrusted networks occurred.
Audit the AVideo host for unauthorized processes, cron jobs, and web-shell files created by the web-server user.

Patch Information

Refer to the GitHub Security Advisory GHSA-j44m-77cc-p3cc for upstream patch status and fixed release information. Upgrade AVideo beyond version 29.0 once the maintainers publish a corrected build that sanitizes keyword input in listFFmpegProcesses().

Workarounds

Block or reverse-proxy-filter requests to plugin/API/standAlone/ paths at the edge until an upstream fix is applied.
Run the AVideo web-server process under a dedicated, low-privilege account with no shell access and restrictive filesystem permissions.
Apply mandatory access controls (SELinux, AppArmor) to constrain the web-server user from spawning arbitrary interpreters.
Deploy a web application firewall rule to reject request parameters containing single quotes or shell metacharacters targeting the affected endpoint.

bash

# Example nginx snippet to block access to the standalone API from untrusted sources
location ^~ /plugin/API/standAlone/ {
    allow 10.0.0.0/8;
    deny all;
}