The vulnerability arises from an incomplete sanitization of external URLs within AVideo's test.php. While the wget pathway now applies escapeshellarg, the file_get_contents and curl calls remain unsanitized, permitting an attacker to embed shell commands in specially crafted URLs such as httpevil.com. This flaw enables full remote command execution on the host, compromising confidentiality, integrity, and availability through CWE‑78.

AVideo, an open‑source video platform developed by WWBN, is affected for all releases up to and including version 29.0. The fix addressed in commit 78bccae74634ead68aa6528d631c9ec4fd7aa536 removes the unsanitized code paths and is present in newer releases.

The CVSS score of 9.3 indicates a critical vulnerability. EPSS data is presently unavailable, and the issue is not listed in the CISA KEV catalog. Exploitation requires an externally reachable HTTP request to test.php with a malicious URL as input. Once the vulnerable code executes, an attacker achieves full command execution, making the risk high for exposed deployments.