Vulnerability · Published Mar 22, 2026 · Assigned by GitHub_M

CVE-2026-33319AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

Medium 5.9

In plain English

A medium-severity OS command injection in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.3%top 73.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo is an open source video platform. Prior to version 26.0, the `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via `escapeshellarg()`. If an attacker can influence the LinkedIn API response (via MITM, compromised OAuth token, or API compromise), they can inject arbitrary OS commands that execute as the web server user. Version 26.0 contains a fix for the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	wwbn/avideo	no fix listed	GHSA-w5ff-2mjc-4phc

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	< 26.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-w5ff-2mjc-4phc x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/67d932eb05e1bc9b36796f73ff4f9fb47590598b x_refsource_MISC