CVE-2026-29058
WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php
描述
## Impact An unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the `base64Url` GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption. ## Root Cause The `base64Url` parameter is Base64-decoded and then interpolated directly into a double-quoted `ffmpeg` shell command without proper shell escaping. The upstream validation uses `FILTER_VALIDATE_URL`, which validates URL syntax but does not prevent shell metacharacters / command substitution sequences from being interpreted by the shell. ## Affected Components * `objects/getImage.php` * `objects/security.php` * Execution path via async command execution helper (`shell_exec`/`nohup`) ## Patches Apply strict shell argument escaping (e.g., `escapeshellarg()`) to all user-supplied values before building any shell command, and avoid double-quoted interpolation of untrusted input. Prefer safer process execution patterns where possible. ## Workarounds * Restrict access to `objects/getImage.php` at the web server / reverse proxy layer (IP allowlist, auth, or disable endpoint if not needed). * Apply WAF rules to block suspicious patterns and limit exposure until a patch is deployed. ## Resources * Report: "Unauthenticated OS Command Injection in AVideo-Encoder"
如何修補 CVE-2026-29058
要修補 CVE-2026-29058,請將受影響套件升級到下列已修補版本。
- —升級至 7.0.0 或更新版本
CVE-2026-29058 正在被利用嗎?
低 — EPSS 為 2.1%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 7.0.0