CVE-2026-33482OS Command Injection in Avideo

Severity
8.1HIGHNVD
EPSS
0.1%
top 74.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
Latest updateMar 20
PublishedMar 23

Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&&`, `;`, `|`, `` ` ``, ``). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a vali

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages2 packages

NVDwwbn/avideo26.0
Packagistwwbn/avideo26.0

Patches

🔴Vulnerability Details

2
GHSA
AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()2026-03-20
OSV
AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()2026-03-20

🕵️Threat Intelligence

1
Wiz
CVE-2026-33482 Impact, Exploitability, and Mitigation Steps | Wiz