AVideo OS Command Injection via FFmpeg Parameter Concatenation

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into these fields to execute OS commands as the web-server user.

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

AVideo through version 29.0 suffers from an OS command injection vulnerability in the ffmpeg.json.php endpoint where user-supplied parameters (notifyCode and callback) are directly concatenated into shell commands without proper escaping or sanitization. This is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) vulnerability that allows attackers to break out of the intended command context and execute arbitrary operating system commands. While the vulnerability requires crafting a valid encrypted payload—raising the barrier to entry—successful exploitation grants an attacker code execution with the privileges of the web server process, potentially leading to full system compromise. Organizations running AVideo instances, particularly those exposed to the internet or accessible to untrusted network segments, face significant risk from this high-severity flaw (CVSS 8.1).

Casky's 446 matched skills detect this attack pattern by analyzing command injection techniques mapped across MITRE ATT&CK's Initial Access (TA0001), Resource Development (TA0043), and Execution (TA0002) phases. Practitioners using Casky would observe detections correlating: (1) suspicious API requests to ffmpeg.json.php with encoded or obfuscated parameters, (2) shell metacharacter sequences (pipes, semicolons, command substitution syntax) appearing in normalized parameter payloads, and (3) subsequent process execution events spawning unexpected child processes under the web server context. Claude's extended reasoning capability enables Casky to correlate payload structure anomalies with behavioral indicators—flagging not just the malicious request, but the execution chain that follows—allowing security teams to distinguish true exploitation attempts from benign activity and respond with precision.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-63305.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-63305

Casky has 446 skills that investigate the attack patterns behind CVE-2026-63305. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn