CVE-2026-33648

Katalog CVE

CVSS 8.8 · High EPSS 0,92%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada wwbn avideo. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a log file path by embedding user-controlled `users_id` and `liveTransmitionHistory_id` values from the JSON request body without any sanitization. This log file path is then concatenated directly into shell commands passed to `exec()`, allowing an authenticated user to achieve arbitrary command execution on the server via shell metacharacters such as `$()` or backticks. Commit 99b865413172045fef6a98b5e9bfc7b24da11678 contains a patch.

Rincian

Terbit di NVD

23 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,92% peluang dieksploitasi; lebih tinggi dari 59,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WWBN/AVideo/security/advisories/GHSA-5m4q-5cvx-36mw exploit · advisory vendor
• https://github.com/WWBN/AVideo/commit/99b865413172045fef6a98b5e9bfc7b24da11678 patch