CVE-2026-41064 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: WWBN. 📦 **Product**: AVideo (PHP-based video platform). ⚠️ **Affected**: Versions **29.0 and earlier**. If you are running an older version, you are vulnerable.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: LOW. 🚫 **Auth**: None required (PR:N). 🌐 **Network**: Network accessible (AV:N). 🧠 **Complexity**: Low (AC:L). No user interaction needed (UI:N). It is a critical, easy-to-exploit remote vulnerability.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for `test.php` endpoints. 📡 **Indicator**: Look for requests involving `file_get_contents` or `curl` with suspicious URL parameters. Check if the server is running AVideo version 29.0 or below.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed?**: Yes. 🛠️ **Patch**: WWBN released fixes via GitHub commits (e.g., `1e6cf03`, `78bccae`). 📥 **Action**: Update AVideo to the latest version immediately to apply the security patches.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL. 🚨 **Priority**: P1. With CVSS High severity and no auth required, this is an immediate threat. Patch immediately or isolate the server from the internet.

Updated May 06, 2026 CVSS 9.3 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: OS Command Injection in WWBN AVideo. 📉 **Consequences**: Arbitrary Code Execution (RCE).…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-78 (OS Command Injection). 🔍 **Flaw**: Incomplete fix in `test.php`. The code uses `file_get_contents` and `curl` without cleaning paths.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: WWBN. 📦 **Product**: AVideo (PHP-based video platform). ⚠️ **Affected**: Versions **29.0 and earlier**. If you are running an older version, you are vulnerable.

Q4What can hackers do? (Privileges/Data)

💀 **Privileges**: Full System Control. 📂 **Data**: Complete compromise. Attackers can execute arbitrary commands with the privileges of the web server process.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: LOW. 🚫 **Auth**: None required (PR:N). 🌐 **Network**: Network accessible (AV:N). 🧠 **Complexity**: Low (AC:L). No user interaction needed (UI:N). It is a critical, easy-to-exploit remote vulnerability.

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp?**: Yes. 🐙 **Source**: GitHub commits and security advisories (GHSA-pq8p-wc4f-vg7j, GHSA-3fpm-8rjr-v5mc) confirm the flaw and fixes.…

Read full answer (login)

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for `test.php` endpoints. 📡 **Indicator**: Look for requests involving `file_get_contents` or `curl` with suspicious URL parameters. Check if the server is running AVideo version 29.0 or below.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed?**: Yes. 🛠️ **Patch**: WWBN released fixes via GitHub commits (e.g., `1e6cf03`, `78bccae`). 📥 **Action**: Update AVideo to the latest version immediately to apply the security patches.

Q9What if no patch? (Workaround)

🚧 **No Patch?**: Workaround. 🚫 **Block**: Disable or restrict access to `test.php`. 🛡️ **WAF**: Implement strict input validation to block command injection characters.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL. 🚨 **Priority**: P1. With CVSS High severity and no auth required, this is an immediate threat. Patch immediately or isolate the server from the internet.

Continue exploring

Vulnerability detail Full AI analysis (login) WWBN CWE-78