CVE-2026-33482

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&&`, `;`, `|`, `` ` ``, `<`, `>`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.

• CWE-78

• https://github.com/WWBN/AVideo/commit/25c8ab90269e3a01fb4cf205b40a373487f022e1Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-pmj8-r2j7-xg6cExploit, Mitigation, Vendor Advisory

Published

Mar 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33477FileRise is a self-hosted web-based file manager with multi-…4.3
• CVE-2026-33478WWBN AVideo is an open source video platform. In versions up…10
• CVE-2026-33479WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-3348The MinhNhut Link Gateway plugin for WordPress is vulnerable…4.4
• CVE-2026-33480WWBN AVideo is an open source video platform. In versions up…8.6
• CVE-2026-33481Syft is a a CLI tool and Go library for generating a Softwar…5.3
• CVE-2026-33483WWBN AVideo is an open source video platform. In versions up…7.5
• CVE-2026-33484Langflow is a tool for building and deploying AI-powered age…7.5
• CVE-2026-33485WWBN AVideo is an open source video platform. In versions up…7.5
• CVE-2026-33486Roadiz is a polymorphic content management system based on a…6.5
• CVE-2026-33487goxmlsig provides XML Digital Signatures implemented in Go. …7.5
• CVE-2026-33488WWBN AVideo is an open source video platform. In versions up…8.1