The vulnerability occurs when a W3BC‑based video platform concatenates a user‑supplied ID, an m3u8 location, and a transmission history identifier into a shell command that is executed asynchronously. The values are only single‑quoted but not escaped, allowing an attacker to insert shell metacharacters that terminate the quoted portion and append arbitrary commands. This flaw provides remote code execution on the hosting server, giving full control over the system’s confidentiality, integrity, and availability.

This flaw is present in the WWBN AVideo open‑source video platform, version 29.0 and all earlier releases. It resides in the on_publish.php file of the YPTSocket notification branch within the Live plugin. Any installation of these affected versions that exposes the publish endpoint to untrusted clients is at risk. No other vendors, products, or newer releases are known to be impacted.

The CVSS score of 8.8 marks the weakness as high severity and, because it enables arbitrary command execution through a public HTTP endpoint, the exploitation probability is realistic even though EPSS data is not available. The vulnerability is not listed in the CISA KEV catalog, indicating no widely known exploits yet. An attacker who can influence the m3u8 URL and associated identifiers can run arbitrary shell commands, potentially compromising the entire server.