Packagist/wwbn/avideo CVE-2026-29058: critical 9.8, EPSS 8.94%
WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php
Action: Upgrade wwbn/avideo to 7.0.0 or later.
composer require wwbn/avideo:7.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.0.0 | - |
Fixed versions
| 7.0.0 |
Sources
- osv: GHSA-9j26-99jh-v26q
- https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-9j26-99jh-v26q
- https://nvd.nist.gov/vuln/detail/CVE-2026-29058
- https://github.com/WWBN/AVideo-Encoder
CVE-2026-29058 · published · modified · JSON