A command injection vulnerability (CWE-78), coupled with input validation failures (CWE-20) and missing authentication (CWE-306), exists in Serviio Media Server. The flaw allows an attacker to send crafted HTTP requests to the /rest/action endpoint, where a VIDEO parameter is passed unsanitized into a call to cmd.exe. This results in arbitrary command execution under the privileges of the web server process, giving the attacker full control over the affected Windows system and compromising confidentiality, integrity, and availability.

Serviio Media Server versions 1.4 through 1.8 running on Windows are affected. The vulnerability is exposed on the default REST API port 23423 and does not require authentication because the console component lacks access controls.

The CVSS score of 9.3 indicates a severe risk, and the EPSS score of 3% reflects a low likelihood of exploitation. While not listed in CISA KEV, the lack of authentication and the prevalence of the exposed API mean attackers can remotely access the vulnerability by sending HTTP requests from any network location that can reach port 23423. The exploit path is straightforward: craft a VIDEO parameter containing malicious commands and submit via the REST API, resulting in code execution with web‑server privileges.