CVE-2026-33482 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&&`, `;`, `|`, `` ` ``, `<`, `>`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.
A command injection vulnerability has been identified in WWBN AVideo versions through 26.0. The issue arises in the 'sanitizeFFmpegCommand()' function within 'plugin/API/standAlone/functions.php', which is intended to sanitize FFmpeg commands by removing hazardous shell metacharacters. However, it fails to eliminate the '$()' syntax used for command substitution in Bash. This oversight allows an attacker to execute arbitrary commands on the standalone encoder server by crafting a specific encrypted payload. The vulnerability is exploited by sending a malicious FFmpeg command that takes advantage of the unsanitized command substitution, leading to unauthorized command execution on the server.
Users are advised to update to the patched version of AVideo, which includes the necessary fix in the FFmpeg command sanitization function. Instructions for updating can be found in the AVideo documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/commit/25c8ab90269e3a01fb4cf205b40a373487f022e1 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-pmj8-r2j7-xg6c | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | New CVE Received | [email protected] |