CVE-2026-64625: AVideo RCE Vulnerability in Live Plugin

CVE-2026-64625 Overview

CVE-2026-64625 is an OS command injection vulnerability in AVideo versions before 29.0. The flaw exists in the execAsync() function, which re-wraps escaped commands in a double-quoted sh -c context. This shell wrapping allows command substitution via $() and backticks, bypassing the escapeshellarg() protection. Attackers can inject arbitrary operating system commands through the Live plugin on_publish.php endpoint. The issue represents an incomplete fix for CVE-2026-45578. The vulnerability is remotely exploitable without authentication or user interaction and falls under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
Unauthenticated remote attackers can execute arbitrary OS commands on servers running AVideo before version 29.0, leading to full server compromise.

Affected Products

AVideo (WWBN) versions prior to 29.0
AVideo Live plugin (on_publish.php endpoint)
Deployments relying on the previous CVE-2026-45578 fix

Discovery Timeline

2026-07-20 - CVE-2026-64625 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64625

Vulnerability Analysis

AVideo's execAsync() function is designed to execute shell commands asynchronously. The prior fix for CVE-2026-45578 applied escapeshellarg() to user-controlled arguments to neutralize shell metacharacters. However, the patched implementation subsequently re-wraps the already-escaped command inside a double-quoted sh -c "..." invocation. Inside double quotes, the shell still evaluates command substitution constructs such as $(...) and backticks. As a result, the single-quote-based escaping performed by escapeshellarg() is undone by the outer double-quoted context.

An attacker who submits input containing $(command) or backtick-delimited payloads to the vulnerable endpoint triggers command substitution before the intended command runs. Executed commands inherit the privileges of the web server process, typically enabling data theft, webshell installation, and lateral movement.

Root Cause

The root cause is unsafe shell composition inside execAsync(). Wrapping arguments in double quotes after escaping breaks the security guarantee of escapeshellarg(), which is only valid when the resulting single-quoted string is not further embedded in another shell interpretation layer.

Attack Vector

Exploitation targets the Live plugin endpoint plugin/Live/on_publish.php. This endpoint is reachable over the network, requires no authentication, and passes attacker-controlled parameters into execAsync(). A crafted HTTP request containing shell substitution syntax achieves remote code execution as the web server user.

The vulnerability is described in the GitHub Security Advisory GHSA-rc5x-vh5v-473f and the VulnCheck Advisory on AVideo. No verified public exploit code is available at the time of writing.

Detection Methods for CVE-2026-64625

Indicators of Compromise

HTTP requests to plugin/Live/on_publish.php containing $(, `, or URL-encoded equivalents (%24%28, %60).
Unexpected child processes of the web server (php-fpm, apache2, nginx) spawning sh, bash, curl, wget, or nc.
New files written to AVideo videos/ or plugin/ directories outside normal upload workflows.
Outbound network connections from the AVideo host to unfamiliar IP addresses shortly after Live plugin activity.

Detection Strategies

Deploy web application firewall rules that block command substitution syntax in POST parameters submitted to Live plugin endpoints.
Enable process-lineage identification on Linux hosts running AVideo to flag shell interpreters launched by PHP handlers.
Correlate access logs for on_publish.php with process telemetry to identify anomalous command execution chains.

Monitoring Recommendations

Ingest AVideo web server access logs and Linux auditdexecve events into a centralized SIEM for cross-source correlation.
Alert on any invocation of sh -c where the argument string contains $( or backticks originating from the AVideo installation path.
Baseline outbound network traffic from AVideo servers and alert on deviations that follow Live plugin requests.

How to Mitigate CVE-2026-64625

Immediate Actions Required

Upgrade AVideo to version 29.0 or later, which contains the complete fix for execAsync().
Restrict network access to the AVideo Live plugin endpoint to trusted publishers only.
Audit web server processes and file system for signs of prior exploitation before applying the patch.
Rotate credentials, API keys, and secrets accessible to the AVideo host if compromise is suspected.

Patch Information

The vendor addressed CVE-2026-64625 in AVideo 29.0 by correcting the shell composition inside execAsync() so that escaped arguments are no longer re-embedded in a double-quoted sh -c invocation. Details are published in the GitHub Security Advisory GHSA-rc5x-vh5v-473f.

Workarounds

Disable the Live plugin until the upgrade to AVideo 29.0 can be completed.
Block requests to plugin/Live/on_publish.php at the reverse proxy or WAF for untrusted source addresses.
Run the AVideo PHP process under a least-privileged user account with restricted shell access to limit post-exploitation impact.

bash

# Example nginx location block to restrict the vulnerable endpoint
location = /plugin/Live/on_publish.php {
    allow 10.0.0.0/8;      # trusted publishers only
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}