CVE-2026-29058

The AVideo video-sharing platform (versions prior to 7.0 ) is vulnerable to an unauthenticated OS command injection . The root cause is the lack of sanitization for the base64Url GET parameter , which allows attackers to inject shell command substitutions. Specifically, the getImage.php endpoint ...