RCE in Wwbn Avideo
CVE-2026-33482
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&&`, `;`, `|`, `` ` ``, `<`, `>`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.047 (91.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 91.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.042 · newest: 0.047 · change: +0.005
Affected products
- Wwbn Avideo — versions <= 26.0
Weakness classification (CWE)
References
- github.com/WWBN/AVideo/security/advisories/GHSA-pmj8-r2j7-xg6c (Exploit, Mitigation, Vendor Advisory)
- github.com/WWBN/AVideo/commit/25c8ab90269e3a01fb4cf205b40a373487f022e1 (Patch)
Frequently asked questions
- What is CVE-2026-33482?
- CVE-2026-33482 is a high-severity vulnerability in Wwbn Avideo, classified under OS Command Injection. CVSS score: 8.1/10. Published 2026-03-23.
- How severe is CVE-2026-33482?
- High severity. CVSS v3 base score is 8.1 out of 10.