CVE-2026-55173

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier

Description An OS command injection issue exists due to an incomplete fix for a previous vulnerability. The sanitizeFFmpegCommand() function in plugin/API/standAlone/functions.php fails to neutralize the single & character, which acts as a shell background operator and command separator. This allows an attacker who can craft a valid encrypted payload to chain multiple commands and achieve arbitrary command execution on the standalone encoder server. The vulnerability is triggered when the ffmpeg.json.php endpoint processes the codeToExecEncrypted variable, which is then passed to the execAsync() function and executed via sh -c.

Recommendations Update WWBN AVideo to a version later than 29.0. As a temporary mitigation, restrict access to the ffmpeg.json.php endpoint to minimize the risk of exploitation.