https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 09:56:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277012 EUVD-2026-277012 https://cve.radiocsirt.org/vuln/euvd-2026-277012 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33482 <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&amp;&amp;`, `;`, `|`, `` ` ``, `&lt;`, `&gt;`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.</p> <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&amp;&amp;`, `;`, `|`, `` ` ``, `&lt;`, `&gt;`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33482 https://cve.radiocsirt.org/vuln/ghsa-pmj8-r2j7-xg6c <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&amp;&amp;`, `;`, `|`, `` ` ``, `&lt;`, `&gt;`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server.</p> <p>## Details</p> <p>**Vulnerable sanitization function** (`plugin/API/standAlone/functions.php:59-82`):</p> <p>```php function sanitizeFFmpegCommand($command) { $allowedPrefixes = [&#39;ffmpeg&#39;, &#39;/usr/bin/ffmpeg&#39;, &#39;/bin/ffmpeg&#39;]; // Remove dangerous characters $command = str_replace(&#39;&amp;&amp;&#39;, &#39;&#39;, $command); $command = preg_replace(&#39;/\s*&amp;?&gt;.*(?:2&gt;&amp;1)?/&#39;, &#39;&#39;, $command); $command = preg_replace(&#39;/[;|`&lt;&gt;]/&#39;, &#39;&#39;, $command); // Missing: $ ( ) \n // Ensure it starts with an allowed prefix foreach ($allowedPrefixes as $prefix) { if (strpos(trim($command), $prefix) === 0) { return $command; } } return &#39;&#39;; } ```</p> <p>The character class `[;|`&lt;&gt;]` on line 70 does not include `$`, `(`, `)`, or `\n`. This means `$(...)` command substitution passes through completely unmodified.</p> <p>**Execution sink** (`objects/functionsExec.php:656-658`):</p> <p>```php $commandWithKeyword = &#34;nohup sh -c \&#34;$command &amp; echo \\$! &gt; /tmp/$keyword.pid\…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&amp;&amp;`, `;`, `|`, `` ` ``, `&lt;`, `&gt;`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server.</p> <p>## Details</p> <p>**Vulnerable sanitization function** (`plugin/API/standAlone/functions.php:59-82`):</p> <p>```php function sanitizeFFmpegCommand($command) { $allowedPrefixes = [&#39;ffmpeg&#39;, &#39;/usr/bin/ffmpeg&#39;, &#39;/bin/ffmpeg&#39;]; // Remove dangerous characters $command = str_replace(&#39;&amp;&amp;&#39;, &#39;&#39;, $command); $command = preg_replace(&#39;/\s*&amp;?&gt;.*(?:2&gt;&amp;1)?/&#39;, &#39;&#39;, $command); $command = preg_replace(&#39;/[;|`&lt;&gt;]/&#39;, &#39;&#39;, $command); // Missing: $ ( ) \n // Ensure it starts with an allowed prefix foreach ($allowedPrefixes as $prefix) { if (strpos(trim($command), $prefix) === 0) { return $command; } } return &#39;&#39;; } ```</p> <p>The character class `[;|`&lt;&gt;]` on line 70 does not include `$`, `(`, `)`, or `\n`. This means `$(...)` command substitution passes through completely unmodified.</p> <p>**Execution sink** (`objects/functionsExec.php:656-658`):</p> <p>```php $commandWithKeyword = &#34;nohup sh -c \&#34;$command &amp; echo \\$! &gt; /tmp/$keyword.pid\…</p> https://cve.radiocsirt.org/vuln/ghsa-pmj8-r2j7-xg6c