What is the CVSS score of CVE-2026-33648?

CVE-2026-33648 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Avideo are affected by CVE-2026-33648?

WWBN AVideo installations are vulnerable to authenticated command injection attacks that could allow attackers to fully compromise affected servers, including stealing sensitive data, modifying…

How to fix or mitigate CVE-2026-33648?

Within 24 hours: Inventory all AVideo deployments and assess whether they are internet-accessible or used by untrusted users; disable the restreamer endpoint if not operationally critical. Within 7 days: Implement network segmentation to restrict access to AVideo servers and deploy WAF rules blocking suspicious restreamer requests; enforce strict access controls limiting authenticated user privileges. Within 30 days: Establish vendor communication channel for patch availability; prepare migration plan to alternative streaming solutions if WWBN does not release timely patches; conduct security audit of all user accounts with AVideo access.

Avideo CVE-2026-33648

EUVD-2026-14484 HIGH

OS Command Injection (CWE-78)

2026-03-23 GitHub_M

GHSA-5m4q-5cvx-36mw

Command Injection Avideo

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 18:45 euvd

EUVD-2026-14484

Analysis Generated

Mar 23, 2026 - 18:45 vuln.today

CVE Published

Mar 23, 2026 - 18:25 nvd

HIGH 8.8

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a log file path by embedding user-controlled users_id and liveTransmitionHistory_id values from the JSON request body without any sanitization. This log file path is then concatenated directly into shell commands passed to exec(), allowing an authenticated user to achieve arbitrary command execution on the server via shell metacharacters such as $() or backticks. Commit 99b865413172045fef6a98b5e9bfc7b24da11678 contains a patch.

AnalysisAI

WWBN AVideo versions up to and including 26.0 contain a command injection vulnerability in the restreamer endpoint that allows authenticated attackers to execute arbitrary commands on the server. The vulnerability stems from unsanitized user input (users_id and liveTransmitionHistory_id parameters) being embedded directly into shell commands via exec(). With a CVSS score of 8.8, this critical vulnerability requires low attack complexity and low privileges, enabling complete system compromise including data theft, modification, and denial of service.

Technical ContextAI

The vulnerability affects WWBN AVideo (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), an open-source video streaming and management platform. This is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS command injection. The restreamer endpoint accepts JSON requests containing users_id and liveTransmitionHistory_id values, which are used to construct log file paths without validation or sanitization. These unsanitized values are then directly concatenated into shell commands passed to PHP's exec() function, allowing shell metacharacters such as backticks, $(), semicolons, or pipe operators to break out of the intended command context and execute arbitrary system commands with the privileges of the web server process.

RemediationAI

Apply the security patch provided in commit 99b865413172045fef6a98b5e9bfc7b24da11678 available at https://github.com/WWBN/AVideo/commit/99b865413172045fef6a98b5e9bfc7b24da11678, or upgrade to a version of AVideo newer than 26.0 that incorporates this fix. Review the GitHub Security Advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-5m4q-5cvx-36mw for additional guidance from the vendor. Until patching is feasible, implement compensating controls such as restricting access to the restreamer endpoint through web application firewall rules, limiting authenticated user privileges, implementing strict input validation at the network perimeter, and monitoring system logs for suspicious command execution patterns or unexpected process spawning from the web server user context. Consider disabling the restreamer functionality entirely if not required for business operations until the patch can be applied.