Executive brief
WWBN AVideo, an open-source video platform, is vulnerable to a security flaw that allows attackers to execute unauthorized commands on the server. This occurs because the software fails to properly clean user-provided data before passing it to the system's command-line interface. An attacker could exploit this to gain full control over the video encoder server, potentially leading to data theft, service disruption, or the installation of malicious software.
Technical details
An OS command injection vulnerability exists in WWBN AVideo versions 29.0 and below within the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php`. This is a regression/incomplete fix for CVE-2026-33482; while previous fixes blocked command substitution and double-ampersands, they failed to filter the single ampersand (&) shell background operator. The vulnerability is reachable via `ffmpeg.json.php`, which processes encrypted payloads from the `codeToExecEncrypted` parameter and passes them to an `execAsync()` call using `sh -c`. An attacker capable of crafting a valid encrypted payload can chain commands (e.g., using `& curl` or `& nc`) to achieve arbitrary code execution. A patch has been released in commit c1cfa2bea8a351a1d07f5758f82887403e3abf1f.
Affected products
- WWBN AVideo <= 29.0
Timeline
- 2026-06-10: advisory: GitHub Security Advisory GHSA-wc3f-xc32-435f published
- 2026-07-16: disclosed: CVE-2026-55173 published to NVD
- 2026-07-16: patched: Fix committed to repository