CVE-2026-29058

critical · 9.8

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption. This issue has been patched in version 7.0.

9.8

CVSS

2.1%

EPSS (exploit prob.)

81st

EPSS percentile

2026-03-06

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
wwbn	avideo-encoder	< 7.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-9j26-99jh-v26q

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-29058