PT-2026-34216 · Wwbn · Avideo

Published 2026-04-21 · Updated 2026-04-22 · CVE-2026-41064

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1

Description An incomplete fix in the 'test.php' file allows for unsanitized input. While the wget path was secured using escapeshellarg, the file get contents and curl code paths remain unsanitized. Additionally, the URL validation regular expression /^http/ is insufficient as it accepts strings such as 'httpevil[.]com'.

Recommendations Update to a version that includes commit 78bccae74634ead68aa6528d631c9ec4fd7aa536.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-41064

Affected Products

Avideo

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-41064 · Security Note
• https://github.com/WWBN/AVideo/commit/1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 · Note
• https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc · Note
• https://github.com/WWBN/AVideo/security/advisories/GHSA-pq8p-wc4f-vg7j · Note
• https://github.com/WWBN/AVideo/commit/78bccae74634ead68aa6528d631c9ec4fd7aa536 · Note
• https://twitter.com/0dayPublishing/status/2046731918100533352 · Twitter Post