CVE-2026-33648

HIGH EPSS 44.8%
Published Mar 23, 20263mo ago · Modified Jun 17, 20261w ago
8.8 CVSS 3.1
High
Find Similar
Published Mar 23, 2026 3mo ago
Last Modified Jun 17, 2026 1w ago

Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a log file path by embedding user-controlled `users_id` and `liveTransmitionHistory_id` values from the JSON request body without any sanitization. This log file path is then concatenated directly into shell commands passed to `exec()`, allowing an authenticated user to achieve arbitrary command execution on the server via shell metacharacters such as `$()` or backticks. Commit 99b865413172045fef6a98b5e9bfc7b24da11678 contains a patch.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
44.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-78 OS Command Injection Injection

Affected Products 1

VendorProductVersionRange
wwbnavideo* ≤26.0

References 2

  • github.com https://github.com/WWBN/AVideo/commit/99b865413172045fef6a98b5e9bfc7b24da11678
    Patch
  • github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-5m4q-5cvx-36mw
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/WWBN/AVideo/commit/99b865413172045fef6a98b5e9bfc7b24da11678
    Patch