WWBN AVideo OS Command Injection Vulnerability in FFmpeg Command Sanitization

A vulnerability allowing OS command injection has been identified in WWBN AVideo versions through 29.0. The issue arises because the fix for a previous vulnerability (CVE-2026-33482) was incomplete. The 'sanitizeFFmpegCommand' function failed to remove single '&' characters, which are used as command separators in the shell. This oversight allows attackers to execute arbitrary commands by chaining them with '&', exploiting the 'execAsync' function's 'sh -c' command execution sink.

Impact

Successful exploitation allows arbitrary OS command execution on the standalone encoder server. This vulnerability is a follow-up to CVE-2026-33482, with the same impact and exploitation method, but introduces a new bypass by allowing single '&' characters to survive the command sanitization process.

Reproduction

The vulnerability can be reproduced by crafting a payload that includes a single '&' character to separate commands. This payload is then encrypted and sent to the 'ffmpeg.json.php' endpoint, where the 'sanitizeFFmpegCommand' function fails to remove the '&', allowing the injected command to execute on the server.

Remediation

Users are advised to stop applying a metacharacter denylist to a 'sh -c' sink. Instead, build the FFmpeg command invocation as an argument array using 'escapeshellarg()' for each token, which is already implemented in the project at 137 sites. If the denylist approach is retained for defense-in-depth, add '&' to the stripped set.