Critical Zero-Click Vulnerability in AVideo Platform Exposes Servers to Full Takeover A severe security flaw in the AVideo media streaming platform, tracked as CVE-2026-29058, has been disclosed, enabling unauthenticated attackers to execute arbitrary commands and seize control of vulnerable servers. With a critical severity score of 9.8/10, the vulnerability requires no user interaction or privileges, making it particularly dangerous. The flaw stems from improper input handling in AVideo version 6.0, specifically in the `objects/getImage.php` and `objects/security.php` components. Attackers can exploit the `base64Url` parameter by injecting malicious shell commands, which are then executed via ffmpeg without proper sanitization. The platform’s use of `shell_exec` and `nohup` further amplifies the risk, allowing deep system-level compromise. Successful exploitation could lead to full server takeover, data theft, and service disruptions in video streaming environments. The vulnerability was first reported by DanielnetoDotCom and credited to security researcher arkmarta, classified under CWE-78 (improper neutralization of special elements). Mitigation measures include: - Upgrading to AVideo version 7.0 or later, which implements `escapeshellarg()` and removes unsafe command execution practices. - Restricting access to the vulnerable `getImage.php` endpoint via IP whitelisting, authentication, or disabling it entirely. - Deploying Web Application Firewall (WAF) rules to block malicious traffic targeting the flaw. Organizations running affected versions are urged to apply patches immediately to prevent exploitation.