The vulnerability resides in the ffmpeg.json.php script of AVideo through version 29.0. It allows attackers who can construct a valid encrypted payload to inject arbitrary shell metacharacters into the notifyCode and callback parameters. These are concatenated into a shell command without escaping, enabling the execution of arbitrary OS commands with the privileges of the web-server user. This flaw is classified as OS Command Injection (CWE-78) and results in complete compromise of the host machine for the attacker.

AVideo, version 29.0 and earlier, provided by WWBN. No later versions were explicitly listed as affected in the supplied data.

The CVSS score of 9.2 indicates critical severity. The EPSS score of 1% indicates a low but non‑zero exploitation probability, suggesting that while instances of exploitation may be rare, the risk remains significant due to the severity of the flaw. The vulnerability is not listed in the CISA KEV catalog, yet the nature of OS command injection presents a substantial attack surface. Attackers can exploit the flaw remotely through HTTP requests directed at the ffmpeg.json.php endpoint once they can supply a crafted encrypted payload. The exploitation requires knowledge of the encryption mechanism but does not necessitate local access or user interaction beyond sending the malicious request.