The vulnerability allows an unauthenticated attacker to supply a crafted base64Url value in the GET request to objects/getImage.php. This value is decoded and interpolated into an OS command, enabling arbitrary shell command execution. The impact is severe: the attacker can obtain full server control, exfiltrate configuration data and credentials, and disrupt services. The weakness is a classic OS command injection (CWE‑78).

Affected systems are installations of the AVideo‑Encoder product from WWBN, any version prior to 7.0. The product is a video‑sharing platform; the vulnerability exists in the objects/getImage.php endpoint for all pre‑7.0 releases. No specific sub‑versions are listed, so the entire pre7.0 release line is vulnerable.

The CVSS score of 9.8 indicates critical severity, and an EPSS percentile of 51% shows a high likelihood of exploitation in the wild. Because the issue is unauthenticated and uses a standard HTTP request, attackers only need network visibility to the target, making the attack vector broadly open. The vulnerability is not yet listed in the CISA KEV catalog, but the risk profile warrants immediate action. Exploitation requires constructing a base64Url payload that, when decoded, injects command substitution into the server; if the application does not validate or sanitize the input, the command will run with the web process’s permissions.