CVE-2026-63305 describes an OS command injection vulnerability in WWBN's AVideo product up to version 29.0. The issue occurs in the ffmpeg.json.php endpoint where the notifyCode and callback parameters are used unsafely in shell command construction without escaping special characters. This allows attackers able to supply a valid encrypted payload to inject shell metacharacters and execute arbitrary OS commands as the web-server user. The vulnerability is rated critical with a CVSS 4.0 score of 9.2. No official patch or remediation guidance has been published yet, and there are no known exploits in the wild.

Successful exploitation allows an attacker to execute arbitrary operating system commands on the server hosting AVideo with the privileges of the web-server user. This can lead to full system compromise, data theft, or service disruption. The vulnerability requires the attacker to craft a valid encrypted payload to trigger the injection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to ffmpeg.json.php. Avoid exposing this endpoint to untrusted users. Follow vendor updates for patches or official mitigations.