Beveiligingsadvies

CVE-2026-64625

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-20 21:50:54

Laatst bijgewerkt 2026-07-23 14:35:06

Toegewezen door VulnCheck

CVSS-score 9.8

Status PUBLISHED

Beschrijving

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.

← Alle CVE's bekijken Bekijk op cve.org ↗