Is CVE-2026-55173 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55173 being exploited in the wild.

How severe is CVE-2026-55173?

High severity, with a CVSS score of 8.1, published 16 July 2026.

Which products and versions are affected?

wwbn/avideo (Packagist) <= 29.0, ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0.

Is there a fix for CVE-2026-55173?

A patch was published on 2026-07-16: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55173 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55173?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55173: WWBN AVideo OS command injection in sanitizeFFmpegCommand

Q: Is there a fix for CVE-2026-55173?

A patch was published on 2026-07-16: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55173 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55173?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55173 · Severity: high · CVSS 8.1 · Published 2026-07-16

WWBN AVideo, an open-source video platform, is vulnerable to a security flaw that allows attackers to execute unauthorized commands on the server. This occurs because the software fails to properly clean user-provided data before passing it to the system's command-line interface. An attacker could exploit this to gain full control over the video encoder server, potentially leading to data theft, service disruption, or the installation of malicious software.

Technologies: wwbn/avideo (Packagist), WWBN AVideo. Vendors: Packagist, WWBN.

Quick answers

Is CVE-2026-55173 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55173 being exploited in the wild.
How severe is CVE-2026-55173?: High severity, with a CVSS score of 8.1, published 16 July 2026.
Which products and versions are affected?: wwbn/avideo (Packagist) <= 29.0, ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0.
Is there a fix for CVE-2026-55173?: A patch was published on 2026-07-16: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55173 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55173?: Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in WWBN AVideo versions 29.0 and below within the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php`. This is a regression/incomplete fix for CVE-2026-33482; while previous fixes blocked command substitution and double-ampersands, they failed to filter the single ampersand (&) shell background operator. The vulnerability is reachable via `ffmpeg.json.php`, which processes encrypted payloads from the `codeToExecEncrypted` parameter and passes them to an `execAsync()` call using `sh -c`. An attacker capable of crafting a valid encrypted payload can chain commands (e.g., using `& curl` or `& nc`) to achieve arbitrary code execution. A patch has been released in commit c1cfa2bea8a351a1d07f5758f82887403e3abf1f.

Affected products

WWBN AVideo <= 29.0

Identifiers

CVE-2026-55173
GHSA-wc3f-xc32-435f

Timeline

2026-06-10: advisory: GitHub Security Advisory GHSA-wc3f-xc32-435f published
2026-07-16: disclosed: CVE-2026-55173 published to NVD
2026-07-16: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.