VulnSocial

CVE-2026-33482Disclosure(wwbn / avideo)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&&`, `;`, `|`, `` ` ``, `<`, `>`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.

wwbn CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • avideo

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-03-23); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
wwbn
Products
avideo

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-23: 2Mentions · 2026-06-23: 1Technical Details · 2026-03-23: 2Technical Details · 2026-06-23: 103-2306-23
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-232
Disclosure1General1
2026-06-231
Disclosure1
Full discourse3 posts
  • DailyCVE@dailycve
    Disclosure

    🔴 AVideo (WWBN AVideo) #OS Command Injection via Ampersand Bypass (#CVE-2026-33482 Incomplete Fix) – Critical -DC-Jun2026-586 https://dailycve.com/avideo-wwbn-avideo-os-command-injection-via-ampersand-bypass-cve-2026-33482-incomplete-fix-critical-dc-jun2026-586/

    Post summary

    The post discloses a new OS command injection vulnerability (CVE-2026-33482) in AVideo, noting an incomplete fix but providing no evidence of active exploitation or specific patch details.

    0000054
    216 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-33482 Command Injection Vulnerability in WWBN AVideo Standalone Encoder via Bash Substitution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33482

    Post summary

    The text merely cites CVE-2026-33482 with a brief description of a command‑injection flaw, lacking additional details on PoC, exploit, patch, or active exploitation.

    0000036
    4.0K followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🟠 CVE-2026-33482 - High WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS c... https://www.thehackerwire.com/vulnerability/CVE-2026-33482/ https://t.co/diSp4XSFFZ

    Post summary

    CVE-2026-33482 is an OS command injection flaw in WWBN AVideo versions up to 26.0 due to insufficient input sanitization in the `sanitizeFFmpegCommand()` function, as disclosed by The Hacker Wire.

    0000044
    144 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appwwbnavideo---

Explore more

Back to dashboardwwbn CVEsavideo vulnerabilities