CVE-2026-41064CWE-78

AVideo has an incomplete fix for CVE-2026-33502 (Command Injection)

Critical · published April 21, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
39.4
In the wild
Unconfirmed
What it is

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget but leaves the `file_get_contents` and `curl` code paths unsanitized, and the URL validation regex `/^http/` accepts strings like `httpevil[.]com`. Commit 78bccae74634ead68aa6528d631c9ec4fd7aa536 contains an updated fix.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00467 · 39.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-04-21T23:04Z
EPSS history
Timeline
  • 21 APR 23:04Z
    AVideo has an incomplete fix for CVE-2026-33502 (Command Injection)
    cvelistv5