This vulnerability arises when the uploadVideoToLinkedIn() method builds a shell command by directly inserting a LinkedIn API upload URL without escaping. The resulting OS command injection allows an attacker who can manipulate the API response—including via man‑in‑the‑middle attacks, compromised OAuth tokens, or API compromise—to execute arbitrary commands as the web server user. The impact is full remote code execution and potential system compromise.

The affected product is WWBN AVideo, an open source video platform, for all versions prior to 26.0. The vulnerability is present in the SocialMediaPublisher plugin's uploadVideoToLinkedIn() routine. Users running AVideo 25.x or earlier are at risk.

The CVSS base score of 5.9 indicates a medium severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to influence the LinkedIn API response, which might be achieved via network attacks or credential compromise. Because the payload runs as the web server process, the attacker could gain system‑level access if the web server runs with elevated privileges.