WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget but leaves the `file_get_contents` and `curl` code paths unsanitized, and the URL validation regex `/^http/` accepts strings like `httpevil[.]com`. Commit 78bccae74634ead68aa6528d631c9ec4fd7aa536 contains an updated fix.

Affected: Packagist: wwbn/avideo

### Summary

The incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget but leaves the `file_get_contents` and `curl` code paths unsanitized, and the URL validation regex `/^http/` accepts strings like `httpevil.com`.

### Affected Package

- **Ecosystem:** Other - **Package:** AVideo - **Affected versions:** < commit 1e6cf03e93b5 - **Patched versions:** >= commit 1e6cf03e93b5

### Details

The vulnerable `wget()` function in `plugin/Live/test.php`:

```php function wget($url, $filename) { $cmd = "wget --tries=1 {$url} -O {$filename} --no-check-certificate"; exec($cmd); } ```

Neither `$url` nor `$filename` is passed through `escapeshellarg()`. The URL validation uses `preg_match("/^http/", $url)` which: - Does not require `://` (matches `httpevil.com`) - Does not block shell metacharacters (`;`, backticks, `$()`) - Does not validate the URL is actually a URL

A payload like `http://x; id > /tmp/pwned; echo ` passes the regex and injects arbitrary commands via the semicolons.

The fix adds `escapeshellarg()` for the wget path and an `isAllowedStatsTestURL` allowlist, but `url_get_contents()` (used by the same endpoint) still follows redirects without validation. The wget-specific fix does not protect the `file_get_contents` and `curl` code paths that handle the same user-supplied URL.

### PoC

```python """ CVE-2026-33502 - Command injection in AVideo plugin/Live/test.php

Tests REAL vulnerable code from: plugin/Live/test.php (commit pre-1e6cf03)

T…