AVideo before version 29.0 implements execAsync by re‑wrapping escaped commands in double‑quoted sh -c, which unintentionally permits command substitution via $() and backticks. This bypasses the previously applied escapeshellarg protection and allows a malicious actor to execute arbitrary operating‑system commands through the Live plugin’s on_publish.php endpoint. The injected commands could read, modify, or delete data and give an attacker control over the host server, thus compromising confidentiality, integrity, and availability. This vulnerability is a CWE‑78 OS command injection.

WWBN AVideo, all releases prior to 29.0, with the Live plugin’s on_publish.php endpoint serving as the primary attack surface.

The CVSS score of 9.3 indicates a high‑severity Remote Code Execution risk. The EPSS score of less than 1 % suggests a low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalogue. Based on the exposed on_publish.php endpoint, the likely attack vector is remote network access; an attacker can trigger the injection by sending a crafted request that includes $() or backticks to this endpoint, a conclusion inferred from the description.