The flaw is an OS command injection in the listFFmpegProcesses() function of AVideo, where unsanitized keyword parameters are interpolated inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can break out of the grep context and execute arbitrary OS commands as the web‑server user, leading to full system compromise. This weakness falls under CWE‑78.

The vulnerability affects the WWBN AVideo content‑management application up to and including version 29.0. Any installation of AVideo 29.0 or earlier that has not applied an update is vulnerable. The flaw resides in plugin/API/standAlone/functions.php, a component accessed via the web API and likely exposed through the AVideo web interface.

The CVSS score of 9.2 indicates critical severity, while the EPSS score of approximately 1.4% suggests a low but nonzero likelihood of exploitation. Based on the description, it is inferred that a malicious actor must have access to the application’s API and be able to craft a specialized encrypted payload, which limits the attack surface but does not eliminate the risk. The vulnerability is not listed in CISA’s KEV catalog, but the high severity and the ability to execute arbitrary commands as the web‑server user make it a significant threat if exploited.