CVE-2026-29058: exploitation status and patch state

CVE-2026-29058 · CVSS 9.8 CRITICAL · EPSS 2%

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption. This issue has been patched in version 7.0.

Is CVE-2026-29058 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 2%.
• Public exploit code: packaged in a public tool.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2026-29058

• Metasploit Framework 6.4.123 Adds Two Exploits (2026-03-21)

Primary sources

• NVD record
• Metasploit: exploit/linux/http/avideo_encoder_getimage_cmd_injection

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.