CVE-2026-63305 is an OS command injection vulnerability in WWBN's AVideo product affecting versions up to 29.0. The issue arises in the ffmpeg.json.php endpoint where the notifyCode and callback parameters are directly concatenated into a shell command without escaping special characters. This allows an attacker who can provide a valid encrypted payload to inject shell metacharacters and execute arbitrary OS commands as the web-server user. The vulnerability is rated critical with a CVSS 4.0 score of 9.2, indicating high impact and complexity requiring partial attack prerequisites.

Successful exploitation allows remote attackers to execute arbitrary operating system commands with the privileges of the web-server user. This can lead to full system compromise, data theft, or service disruption. The attack requires crafting a valid encrypted payload, which adds some complexity to exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and validate or sanitize inputs to the notifyCode and callback parameters if possible. Monitor for updates from WWBN regarding patches or official mitigations.