CVE-2026-33482

Katalog CVE

CVSS 8.1 · High EPSS 4,7%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada wwbn avideo. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&&`, `;`, `|`, `` ` ``, `<`, `>`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.

Rincian

Terbit di NVD

23 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

4,7% peluang dieksploitasi; lebih tinggi dari 91,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WWBN/AVideo/security/advisories/GHSA-pmj8-r2j7-xg6c exploit · mitigasi · advisory vendor
• https://github.com/WWBN/AVideo/commit/25c8ab90269e3a01fb4cf205b40a373487f022e1 patch