AVideo's restreamer endpoint enables arbitrary OS command execution by ignoring user-supplied values used to build a shell command. An attacker who can authenticate to the API can inject shell meta‑characters in the JSON body fields `users_id` and `liveTransmitionHistory_id`, causing the server to execute commands via exec(). This flaw is an instance of OS Command Injection (CWE‑78), allowing complete compromise of confidentiality, integrity and availability of the host.

Version 26.0 and earlier of the WWBN AVideo open‑source video platform are affected. Any installation using these releases is vulnerable when the restreamer API is exposed to authenticated users. The vulnerability is specific to the restreamer component and only impacts systems that host the AVideo service.

The CVSS score of 8.8 classifies the flaw as High severity. The EPSS score indicates a low probability of exploitation (<1%), and it is not yet listed in CISA’s KEV catalog. Nonetheless, exploitation requires only authenticated access to the restreamer endpoint, which is commonly available to content creators and administrators. An attacker could gain shell access, modify files, install malware or exfiltrate data. Until a patch is applied, the risk remains appreciable, especially if the endpoint is exposed to the internet.