PT-2026-34216 · Avideo · Avideo

Published 2026-04-14 · Updated 2026-04-25 · CVE-2026-41064

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1

Description An incomplete fix in the 'test.php' file allows for unsanitized input. While the wget path was secured using escapeshellarg, the file get contents and curl code paths remain unsanitized. Additionally, the URL validation regular expression /^http/ is insufficient as it accepts strings such as 'httpevil[.]com'.

Recommendations Update to a version that includes commit 78bccae74634ead68aa6528d631c9ec4fd7aa536.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-41064

GHSA-PQ8P-WC4F-VG7J

Affected Products

Avideo

References · 12

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc · Exploit
• https://github.com/WWBN/AVideo/commit/78bccae74634ead68aa6528d631c9ec4fd7aa536 · Patch
• https://github.com/WWBN/AVideo/commit/1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-pq8p-wc4f-vg7j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41064 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33502 · Security Note
• https://osv.dev/vulnerability/GHSA-pq8p-wc4f-vg7j · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/VulmonFeeds/status/2046832997303726560 · Twitter Post
• https://twitter.com/0dayPublishing/status/2046731918100533352 · Twitter Post
• https://twitter.com/infoflowcloud/status/2048169360720568499 · Twitter Post
• https://twitter.com/CVEnew/status/2048168409775644908 · Twitter Post