External risk intelligence

AVideo Live Plugin OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-64625

AVideo is a video streaming platform typically deployed as a public-facing web application. The vulnerability is reachable via a web endpoint (on_publish.php) that is commonly exposed to the internet to facilitate video broadcasting and publishing, placing this component within the standard, internet-facing attack surface of the application.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in AVideo that allows attackers to execute arbitrary operating system commands. The flaw exists because of an incomplete fix for a previous issue, where certain command executions were not properly escaped, leaving them susceptible to injection. This could potentially allow unauthorized access and control over the affected systems.

Attackers can run unauthorized commands on systems.
Critical flaw in widely used video streaming software.
Assess AVideo systems for exposure and impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the Live plugin's on_publish.php endpoint. This endpoint is exposed externally and does not require prior authentication or user interaction to trigger. The vulnerability lies in how the application handles and re-wraps escaped commands, allowing an attacker to inject and execute arbitrary operating system commands. This could lead to a full compromise of the affected system.

No authentication or user interaction needed.
Injection via the Live plugin's on_publish.php.
Arbitrary OS command execution risk.

Live Threat

Current exploitation, exposure, and threat context

Attackers could inject arbitrary operating system commands through the Live plugin's on_publish.php endpoint. This is possible because of an incomplete fix that re-wraps escaped commands in double-quoted sh -c, allowing command substitution.

OS commands.
Web endpoint access.
Service compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The identified command injection vulnerability in AVideo's Live plugin requires immediate attention from teams responsible for application security and platform operations. The first practical step is to confirm the presence and exposure of the affected AVideo instances, determine their business criticality, and identify the accountable system owners to plan a coordinated remediation strategy.

Application owners should verify exposure.
Confirm reachability and business criticality.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AVideo?

AVideo is an open-source video streaming platform used to build websites for hosting, sharing, and broadcasting video content. It provides features like live streaming and media management, often functioning as a web-based portal. Because it handles media publishing, it is typically deployed on servers accessible to both content creators and viewers, making it a central component in an organization's media delivery infrastructure.

What does CWE-78 mean for CVE-2026-64625?

CWE-78, or OS Command Injection, occurs when an application fails to properly filter user-supplied input before passing it to a system shell. In this case, AVideo attempts to secure commands, but the logic incorrectly re-wraps these commands in a way that allows shell-special characters—like backticks or dollar signs—to remain active. This flaw allows an attacker to 'break out' of the intended command and execute their own unauthorized OS-level instructions.

How is this vulnerability triggered?

An attacker triggers this bug by sending a crafted request to the on_publish.php endpoint within the AVideo Live plugin. The vulnerability relies on the server's command execution logic; it does not trigger if the request is blocked before reaching the application or if the Live plugin is completely disabled. Simply visiting the site or viewing videos without targeting this specific publishing endpoint will not initiate the injection sequence.

Is my AVideo instance at high risk?

According to Halo Surface Signal, AVideo is typically deployed as a public-facing web application. Since the on_publish.php endpoint is generally exposed to the internet to allow remote video broadcasting, your instance is likely reachable by unauthorized actors. Because this vulnerability does not require authentication or user interaction, any AVideo instance exposed to the internet should be considered high-priority for assessment.

How should I respond to this threat?

Begin by identifying all AVideo installations in your environment and confirming which ones are exposed to the internet. Determine the business criticality of these systems to prioritize your response. Consult the official AVideo security channels to confirm the availability of patches that address this incomplete command execution fix, and coordinate with system owners to apply updates or implement access controls as the primary step to limit potential impact.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.