# CVE-2023-25313: WWBN AVideo command injection in video embedding

Source: https://junglewise.ai/threats/cve-2023-25313-wwbn-avideo-command-injection-in-video-embedding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-02-02. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2023-25313 · Severity: critical · CVSS 9.6 · Published 2023-02-02

AVideo, an open-source video sharing platform, contains a vulnerability that allows an attacker to execute unauthorized commands on the server. By tricking a user into saving a specially crafted video link, an attacker could gain full control over the system, potentially leading to data theft or service disruption. Users should update to version 12.4 or later to resolve this issue.

Technologies: [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo), [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2023-25313 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-25313 being exploited in the wild.

**How severe is CVE-2023-25313?** Critical severity, with a CVSS score of 9.6, published 2 February 2023.

**Which products and versions are affected?** wwbn/avideo (Packagist) < 12.4, ECOSYSTEM:introduced=0,fixed=12.4; WWBN AVideo < 12.4.

**Is there a fix for CVE-2023-25313?** Yes. wwbn/avideo (Packagist): upgrade to 12.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-25313 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2023-25313?** Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wwbn/avideo (Packagist): upgrade to 12.4 or later

  ```sh
  composer require wwbn/avideo:^12.4
  ```


## Technical details

A command injection vulnerability exists in WWBN AVideo versions prior to 12.4 within the 'Embed a video link' functionality. The application fails to properly sanitize user-supplied URLs, allowing an attacker to append shell commands as query strings (e.g., '?whoami'). When a user saves the malicious link, the injected commands are executed on the underlying operating system. This can lead to full remote code execution (RCE). The issue was addressed in commit 236228f15 and officially patched in version 12.4.

## Affected products

- WWBN AVideo < 12.4

## Identifiers

- CVE-2023-25313
- GHSA-pgvh-p3g4-86jw

## Timeline

- 2023-01-31: disclosed: Vulnerability reported to vendor
- 2023-02-02: advisory: GitHub Advisory published
- 2023-04-25: other: NVD published CVE-2023-25313

## References

- [https://api.github.com/users/gonzxph](https://api.github.com/users/gonzxph)
- [https://github.com/gonzxph](https://github.com/gonzxph)
- [https://api.github.com/users/gonzxph/gists%7B/gist_id%7D](https://api.github.com/users/gonzxph/gists%7B/gist_id%7D)
- [https://api.github.com/users/gonzxph/repos](https://api.github.com/users/gonzxph/repos)
- [https://avatars.githubusercontent.com/u/58154356?v=4](https://avatars.githubusercontent.com/u/58154356?v=4)
- [https://api.github.com/users/gonzxph/events%7B/privacy%7D](https://api.github.com/users/gonzxph/events%7B/privacy%7D)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)