{"uuid": "b1be9e9b-661a-48dc-9f91-b521fead64c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29058", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"arkmarta\", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated OS command injection vulnerability\\n          in AVideo Encoder's getImage.php endpoint (CVE-2026-29058).\\n\\n          The base64Url GET parameter is base64-decoded and injected directly into an\\n          ffmpeg shell command within double quotes, without any sanitization or use of\\n          escapeshellarg(). PHP's FILTER_VALIDATE_URL check does not block shell\\n          metacharacters such as $() in the URL path, allowing command substitution.\\n\\n          A crafted URL like http://x/$(cmd) passes FILTER_VALIDATE_URL and is interpolated\\n          into: ffmpeg -i \\\"{$url}\\\" ... resulting in arbitrary command execution as www-data.\\n\\n          The Encoder code is served by the main AVideo Apache container (mounted at\\n          /Encoder), so exploitation gives access to the main application context including\\n          database credentials and configuration.\\n\\n          Fixed in AVideo Encoder version 7.0 (commit 78178d1) which added escapeshellarg()\\n          and shell metacharacter stripping.\", \"disclosure_date\": \"2026-03-05\", \"fullname\": \"exploit/linux/http/avideo_encoder_getimage_cmd_injection\", \"is_install_path\": true, \"mod_time\": \"2026-03-06 21:28:39 +0000\", \"name\": \"AVideo Encoder getImage.php Unauthenticated Command Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/avideo_encoder_getimage_cmd_injection\", \"references\": [\"CVE-2026-29058\", \"GHSA-9j26-99jh-v26q\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:23.790495Z"}