WWBN AVideo, an open source video platform, contains an OS command injection vulnerability (CWE-78) in versions 29.0 and earlier. The issue is located in the YPTSocket notification branch within plugin/Live/on_publish.php, where the execAsync() function builds a shell command by concatenating arguments that are single-quoted but not properly escaped using escapeshellarg(). Specifically, the variables $users_id, $m3u8, and $obj->liveTransmitionHistory_id are interpolated without sanitization, allowing an attacker to inject shell metacharacters by including a single quote (') to break out of the quoted context and append arbitrary commands. This vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an attacker with low privileges to execute arbitrary operating system commands on the affected server. This can lead to full system compromise, including unauthorized data access, modification, and service disruption. The CVSS score of 8.8 reflects the critical impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

No official patch or remediation has been published by the vendor as of the current information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the vulnerable plugin or server components, apply input validation or sanitization where possible, and monitor for suspicious activity related to command execution attempts.