CVE-2026-3682 Details

A critical argument injection vulnerability has been identified in welovemedia FFmate versions through 2.0.15. The issue arises in the FFmpeg command execution feature, where user-controlled parameters are sent directly to the FFmpeg binary without adequate validation or sanitization. Although the application tries to mitigate command injection by escaping characters for the shell, attackers can still exploit FFmpeg's wide range of argument options to execute unintended actions. By creating malicious preset commands that use FFmpeg's metadata writing features, attackers can generate text files with custom content and save them to any location on the filesystem accessible to the application. This could lead to overwriting important system files, injecting SSH keys for remote access, altering application configuration files, and potentially executing arbitrary code remotely.