An OS command injection vulnerability in WWBN AVideo versions up to 26.0 allows unauthenticated remote attackers to gain full system control.

The application fails to properly neutralize the bash command substitution syntax $() within the sanitizeFFmpegCommand() function. This allows an unauthenticated attacker to inject arbitrary commands that execute within a shell context on the underlying encoder server.

Successful exploitation of this flaw grants an attacker the ability to execute arbitrary OS commands with the privileges of the web server process. This can lead to a complete compromise of the encoder server, including unauthorized access to sensitive video data, potential lateral movement within the network, and full system takeover. With a CVSS score of 8.1, the high potential for total system impact necessitates immediate attention.

Immediate Action: Since no official patch version is currently listed, administrators should restrict access to the standalone encoder server via network segmentation or firewall rules until a fix is released. Review the provided GitHub commit (25c8ab90269e3a01fb4cf205b40a373487f022e1) to understand the necessary code changes for manual remediation.

Proactive Monitoring: Monitor server logs for suspicious process execution patterns or unusual shell commands being spawned by the AVideo application process.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block requests containing shell command substitution sequences such as $().

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the availability of proof-of-concept evidence, presents a significant risk to affected infrastructure. Organizations using AVideo must prioritize securing the encoder server environment and monitor for unauthorized command execution until a verified vendor patch is applied to the production environment.