CVE-2026-63304 Details

A command injection vulnerability has been identified in AVideo versions through 29.0. The issue resides in the 'plugin/API/standAlone/functions.php' file, specifically within the 'listFFmpegProcesses()' function. This function improperly handles keyword parameters by interpolating them into a shell command without proper sanitization or escaping. As a result, attackers can craft encrypted payloads to break out of the single-quoted context and execute arbitrary commands on the server as the web server user.

To address this vulnerability, the 'listFFmpegProcesses()' function should be modified to escape the keyword parameter using 'escapeshellarg()' before interpolating it into the command. Alternatively, the calling functions can be updated to pass a sanitized keyword value instead of the raw decrypted one.