https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T13:43:57.019405+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-277012 EUVD-2026-277012 2026-10-15T13:43:57.072941+00:00 EUVD-2026-277012 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33482 fkie_cve-2026-33482 2026-10-15T13:43:57.072978+00:00

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&&`, `;`, `|`, `` ` ``, `<`, `>`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.

 https://cve.radiocsirt.org/vuln/ghsa-pmj8-r2j7-xg6c GHSA-pmj8-r2j7-xg6c — AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand() 2026-10-15T13:43:57.073016+00:00

Affected: Packagist: wwbn/avideo

## Summary

The `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&&`, `;`, `|`, `` ` ``, `<`, `>`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server.

## Details

**Vulnerable sanitization function** (`plugin/API/standAlone/functions.php:59-82`):

```php function sanitizeFFmpegCommand($command) { $allowedPrefixes = ['ffmpeg', '/usr/bin/ffmpeg', '/bin/ffmpeg']; // Remove dangerous characters $command = str_replace('&&', '', $command); $command = preg_replace('/\s*&?>.*(?:2>&1)?/', '', $command); $command = preg_replace('/[;|`<>]/', '', $command); // Missing: $ ( ) \n // Ensure it starts with an allowed prefix foreach ($allowedPrefixes as $prefix) { if (strpos(trim($command), $prefix) === 0) { return $command; } } return ''; } ```

The character class `[;|`<>]` on line 70 does not include `$`, `(`, `)`, or `\n`. This means `$(...)` command substitution passes through completely unmodified.

**Execution sink** (`objects/functionsExec.php:656-658`):

```php $commandWithKeyword = "nohup sh -c \"$command & echo \\$! > /tmp/$keyword.pid\…