https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 16:10:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322757 EUVD-2026-322757 https://cve.radiocsirt.org/vuln/euvd-2026-322757 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45578 <p>WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/on_publish.php builds an execAsync() command line by string concatenation, single-quoting each argument but never calling escapeshellarg(). A &#39; in any of the three interpolated values ($users_id, $m3u8, $obj-&gt;liveTransmitionHistory_id) closes the quoted token and lets the attacker append arbitrary commands.</p> <p>WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/on_publish.php builds an execAsync() command line by string concatenation, single-quoting each argument but never calling escapeshellarg(). A &#39; in any of the three interpolated values ($users_id, $m3u8, $obj-&gt;liveTransmitionHistory_id) closes the quoted token and lets the attacker append arbitrary commands.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45578 https://cve.radiocsirt.org/vuln/ghsa-xw67-cg5f-4m2r <p><strong>Affected:</strong> Packagist: WWBN/AVideo</p> <p>## Summary</p> <p>**Type:** Classic shell-metacharacter injection. The YPTSocket notification branch in `plugin/Live/on_publish.php` builds an `execAsync()` command line by string concatenation, single-quoting each argument but never calling `escapeshellarg()`. A `&#39;` in any of the three interpolated values (`$users_id`, `$m3u8`, `$obj-&gt;liveTransmitionHistory_id`) closes the quoted token and lets the attacker append arbitrary commands. **File:** `plugin/Live/on_publish.php`, line 267. **Root cause:** the developer wrapped each variable in literal single quotes (`&#39;$users_id&#39;`, `&#39;$m3u8&#39;`, `&#39;$obj-&gt;liveTransmitionHistory_id&#39;`) believing this provides shell-quoting. PHP single-quoted-into-shell is not safe quoting; it is just two literal quote characters that the shell pairs greedily. Any embedded `&#39;` closes the outer string and resumes interpretation in the shell. The rest of the AVideo codebase already calls `escapeshellarg()` (137 call sites across the project) for ffmpeg invocations, so the safe primitive is well-known to the project; it was simply omitted from this branch. The endpoint is web-reachable (no `.htaccess` rule restricts `on_publish.php`, no `REMOTE_ADDR` check), so the trigger is a direct HTTP POST without going through nginx-rtmp.</p> <p>## Affected Code</p> <p>**File:** `plugin/Live/on_publish.php`, lines 256-271.</p> <p>```php if (AVideoPlugin::isEnabledByName(&#39;YPTSocket&#39;)) { $array = setLiveKey($lth-&gt;getKey(), $lth-&gt;getLive_servers_id()); @ob_clean(); _ob_start(); $l…</p> <p><strong>Affected:</strong> Packagist: WWBN/AVideo</p> <p>## Summary</p> <p>**Type:** Classic shell-metacharacter injection. The YPTSocket notification branch in `plugin/Live/on_publish.php` builds an `execAsync()` command line by string concatenation, single-quoting each argument but never calling `escapeshellarg()`. A `&#39;` in any of the three interpolated values (`$users_id`, `$m3u8`, `$obj-&gt;liveTransmitionHistory_id`) closes the quoted token and lets the attacker append arbitrary commands. **File:** `plugin/Live/on_publish.php`, line 267. **Root cause:** the developer wrapped each variable in literal single quotes (`&#39;$users_id&#39;`, `&#39;$m3u8&#39;`, `&#39;$obj-&gt;liveTransmitionHistory_id&#39;`) believing this provides shell-quoting. PHP single-quoted-into-shell is not safe quoting; it is just two literal quote characters that the shell pairs greedily. Any embedded `&#39;` closes the outer string and resumes interpretation in the shell. The rest of the AVideo codebase already calls `escapeshellarg()` (137 call sites across the project) for ffmpeg invocations, so the safe primitive is well-known to the project; it was simply omitted from this branch. The endpoint is web-reachable (no `.htaccess` rule restricts `on_publish.php`, no `REMOTE_ADDR` check), so the trigger is a direct HTTP POST without going through nginx-rtmp.</p> <p>## Affected Code</p> <p>**File:** `plugin/Live/on_publish.php`, lines 256-271.</p> <p>```php if (AVideoPlugin::isEnabledByName(&#39;YPTSocket&#39;)) { $array = setLiveKey($lth-&gt;getKey(), $lth-&gt;getLive_servers_id()); @ob_clean(); _ob_start(); $l…</p> https://cve.radiocsirt.org/vuln/ghsa-xw67-cg5f-4m2r