CVE-2026-63305: AVideo RCE Vulnerability via Command Injection

CVE-2026-63305 Overview

CVE-2026-63305 is an OS command injection vulnerability in AVideo through version 29.0. The flaw resides in the ffmpeg.json.php endpoint, where the notifyCode and callback parameters are concatenated directly into a shell command without escaping. An attacker who can craft a valid encrypted payload can inject shell metacharacters into these parameters and execute arbitrary operating system commands as the web-server user. The vulnerability is tracked under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
Successful exploitation grants remote code execution on the underlying host with the privileges of the web-server user, enabling data theft, service disruption, and lateral movement.

Affected Products

AVideo platform, all versions through 29.0
Installations exposing the ffmpeg.json.php endpoint
Deployments where attackers can generate or obtain a valid encrypted payload

Discovery Timeline

2026-07-16 - CVE-2026-63305 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-63305

Vulnerability Analysis

AVideo is an open-source video streaming and hosting platform maintained by WWBN. The ffmpeg.json.php endpoint invokes the ffmpeg binary to process media operations and constructs the command line using untrusted values received in the notifyCode and callback parameters. Because these parameters are concatenated into the shell invocation without proper escaping or quoting, attackers can terminate the intended command and append arbitrary shell syntax. Any injected commands run under the same account as the PHP process, typically www-data, apache, or nginx.

Root Cause

The root cause is improper neutralization of special characters passed to an OS command call site, classified as [CWE-78]. AVideo applies encryption to the request payload but does not sanitize the decrypted parameter values before placing them into a shell string. Metacharacters such as ;, |, &, $(), and backticks retain their shell meaning when the command is executed.

Attack Vector

Exploitation occurs over the network against the HTTP interface. The attacker must be able to produce a valid encrypted payload accepted by the endpoint, which raises the attack complexity but does not require authentication or user interaction. Once a valid payload is crafted, arbitrary commands can be embedded in either notifyCode or callback. The vulnerability details are documented in the GitHub Security Advisory and the VulnCheck Security Advisory. No public proof-of-concept exploit is currently listed.

Detection Methods for CVE-2026-63305

Indicators of Compromise

HTTP POST or GET requests to ffmpeg.json.php containing unusually long or malformed notifyCode or callback parameters.
Web-server processes (php-fpm, apache2, nginx) spawning child shells such as /bin/sh, bash, curl, wget, or python.
Outbound network connections from the AVideo host to previously unseen IP addresses or paste sites following requests to the vulnerable endpoint.
New or modified files in web-accessible directories, particularly PHP webshells written after suspicious ffmpeg.json.php traffic.

Detection Strategies

Deploy web application firewall rules that inspect requests to ffmpeg.json.php for shell metacharacters after decryption or in decoded logs.
Correlate web-server access logs with process-execution telemetry to identify PHP-initiated command chains that invoke shells or download utilities.
Hunt for anomalous parent-child process relationships originating from the AVideo document root using EDR telemetry.

Monitoring Recommendations

Enable verbose logging on the AVideo application and forward access logs to a centralized log platform for correlation.
Monitor the file system for unauthorized changes to PHP files, upload directories, and scheduled task definitions.
Alert on any execution of ffmpeg with arguments that include shell operators or unexpected binaries.

How to Mitigate CVE-2026-63305

Immediate Actions Required

Restrict network access to ffmpeg.json.php at the reverse proxy or WAF until a patched release is deployed.
Audit the AVideo host for signs of prior exploitation, including webshells, unexpected cron jobs, and unknown outbound connections.
Rotate any credentials, API keys, or tokens stored on or accessible from the AVideo server.

Patch Information

Refer to the GitHub Security Advisory GHSA-g9x9-q7qj-6mv5 for the vendor-supplied fix and upgrade guidance. Apply the fixed release published by WWBN as soon as it is available and validate that ffmpeg.json.php properly escapes or rejects shell metacharacters in notifyCode and callback.

Workarounds

Block requests to ffmpeg.json.php from untrusted networks using firewall or ingress rules.
Run the AVideo PHP worker under a dedicated, low-privilege system account with no shell access and restricted file-system permissions.
Enforce strict WAF signatures that drop requests containing shell metacharacters within the notifyCode or callback parameters.

bash

# Example nginx snippet to block external access to the vulnerable endpoint
location = /ffmpeg.json.php {
    allow 127.0.0.1;
    deny all;
}