Critical Zero-Click Command Injection in AVideo Platform Allows Stream Hijacking

#cybersecurity #infosec

Summary

AVideo version 6.0 contains a critical zero-click command injection vulnerability (CVE-2026-29058) that allows unauthenticated attackers to execute arbitrary OS commands and hijack video streams.

Take Action:

If you are using AVideo platform this is urgent and important. Patch ASAP to version 7.0, because your server will be attacked. Until you update today, use a web application firewall or reverse proxy to block access to the getImage.php component.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines