Stream Hijacked: Critical Zero-Click Command Injection Flaw Exposed in AVideo-Encoder

**Critical unauthenticated RCE (CVE-2026-29058, CVSS 9.8)** was disclosed in AVideo-Encoder: an unsafe use of a decoded base64Url GET parameter in objects/getImage.php inserts attacker-controlled data into a double-quoted ffmpeg shell command without proper escaping, enabling command injection and full system compromise; vendor patches are available and immediate mitigations include applying updates, IP allowlisting/WAF protections, or disabling the vulnerable endpoint.