CVE-2026-33319
published 2026-03-22CVE-2026-33319: WWBN AVideo is an open source video platform. Prior to version 26.0, the `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell…
PriorityP352high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
0.32%
24.0th percentile
WWBN AVideo is an open source video platform. Prior to version 26.0, the `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via `escapeshellarg()`. If an attacker can influence the LinkedIn API response (via MITM, compromised OAuth token, or API compromise), they can inject arbitrary OS commands that execute as the web server user. Version 26.0 contains a fix for the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | < 26.0 | 26.0 |
| wwbn | avideo | 0 – 25.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
ghsa·2026-03-19
CVE-2026-33319 [MEDIUM] CWE-78 AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
## Summary
The `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via `escapeshellarg()`. If an attacker can influence the LinkedIn API response (via MITM, compromised OAuth token, or API compromise), they can inject arbitrary OS commands that execute as the web server user.
## Details
The vulnerability exists in `plugin/SocialMediaPublisher/Objects/SocialUploader.php`.
The `initializeLinkedInUploadSession()` method (line 649) sends a POST request to `https://api.linkedin.com/rest/videos?action=initializeUpload` and parses the JSON response at line 693:
OSV
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
osv·2026-03-19
CVE-2026-33319 [MEDIUM] AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
## Summary
The `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via `escapeshellarg()`. If an attacker can influence the LinkedIn API response (via MITM, compromised OAuth token, or API compromise), they can inject arbitrary OS commands that execute as the web server user.
## Details
The vulnerability exists in `plugin/SocialMediaPublisher/Objects/SocialUploader.php`.
The `initializeLinkedInUploadSession()` method (line 649) sends a POST request to `https://api.linkedin.com/rest/videos?action=initializeUpload` and parses the JSON response at line 693:
No detection rules found.
No public exploits indexed.
2026-03-22
Published