CVE-2026-33319: 
PHP vulnerability analysis and mitigation

CVE-2026-33319 is an OS command injection vulnerability in the WWBN AVideo open source video platform, specifically within the uploadVideoToLinkedIn() method of the SocialMediaPublisher plugin. The vulnerability affects all AVideo versions prior to 26.0 and arises from the direct interpolation of an upload URL received from LinkedIn's API response into a shell command without proper sanitization using escapeshellarg(). It was published on March 22, 2026, with a fix released in version 26.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command — OS Command Injection). The uploadVideoToLinkedIn() method in the SocialMediaPublisher plugin constructs a shell command by directly embedding the uploadUrl value returned from LinkedIn's API response without calling escapeshellarg() or any equivalent sanitization function. An attacker who can influence this API response — through a man-in-the-middle (MITM) attack on the HTTP connection to LinkedIn, a compromised OAuth token, or a LinkedIn API-level compromise — can inject arbitrary shell metacharacters into the URL value, causing the web server to execute attacker-controlled OS commands. A detailed proof-of-concept including a malicious JSON payload, proxy interception instructions, the resulting injected shell command, and verification steps is publicly available in the GitHub security advisory (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary OS commands as the web server user (typically www-data), resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker could read sensitive files (including credentials, configuration data, and user-uploaded content), modify or delete application data, install backdoors or web shells, and potentially pivot to other systems on the same network. The scope is limited to the web server's privilege level, but the breadth of access is significant given that web servers often have access to databases and internal services (GitHub Advisory, Red Hat CVE).

A public proof-of-concept exploit is available in the GitHub security advisory, including a step-by-step attack guide with a malicious JSON payload and verification of remote code execution as the www-data user (GitHub Advisory). Exploitation requires low privileges (a valid user account to trigger the LinkedIn upload flow) and high attack complexity due to the need to intercept or manipulate the LinkedIn API response. The EPSS score is approximately 0.025% (0.000250), indicating a currently low probability of widespread exploitation. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE).

1. Reconnaissance: Identify an AVideo instance (version < 26.0) with the SocialMediaPublisher plugin enabled and LinkedIn integration configured. Confirm the target has an active LinkedIn OAuth token.
2. Position for interception: Establish a MITM position between the AVideo server and LinkedIn's API endpoints (e.g., using ARP spoofing, DNS poisoning, or a rogue proxy), or obtain a compromised OAuth token that allows crafting API responses.
3. Trigger the LinkedIn upload flow: As a low-privileged authenticated user, initiate a video upload to LinkedIn through the AVideo interface, causing the server to call LinkedIn's API and receive an upload URL in the response.
4. Inject malicious payload: Intercept the LinkedIn API response and replace the legitimate uploadUrl value with a malicious string containing shell metacharacters, such as: https://api.linkedin.com/upload/legit; id > /tmp/pwned; #
5. Achieve command execution: The AVideo server processes the manipulated response, interpolates the malicious URL directly into a shell command without sanitization, and executes the injected OS commands as the www-data user.
6. Verify and escalate: Confirm execution (e.g., check for created files or reverse shell callback), then escalate by deploying a web shell, exfiltrating credentials, or pivoting to internal services (GitHub Advisory).

• Network: Unexpected outbound connections from the AVideo web server to non-LinkedIn IP addresses following a LinkedIn video upload attempt; anomalous DNS queries or TLS certificate mismatches for api.linkedin.com suggesting MITM interception.
• Logs: Web server access logs showing LinkedIn upload API calls followed immediately by unusual process spawning; PHP error logs or application logs referencing uploadVideoToLinkedIn() with malformed URL values.
• File System: Unexpected files created in /tmp/ or the web root by the www-data user; new or modified PHP files (potential web shells) in the AVideo installation directory; unauthorized cron jobs added under the web server account.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., /bin/bash, curl, wget, nc, python) not associated with normal AVideo operation; reverse shell connections originating from the web server process (GitHub Advisory).

Upgrade WWBN AVideo to version 26.0 or later, which applies the fix in commit 67d932eb05e1bc9b36796f73ff4f9fb47590598b that properly sanitizes the LinkedIn API upload URL using escapeshellarg() before shell command construction (GitHub Advisory, GitHub Commit). For instances that cannot be upgraded immediately, restrict outbound network access from the AVideo server to LinkedIn API endpoints and enforce TLS certificate pinning to reduce MITM risk. Additionally, audit and rotate any LinkedIn OAuth tokens associated with the AVideo instance, and monitor application logs for signs of API response manipulation.

The vulnerability was noted in automated CVE tracking feeds and security databases shortly after publication in March 2026, with coverage on platforms including cvefeed.io, vuldb.com, and INCIBE-CERT (INCIBE-CERT). A technical write-up was published at infinitsec.net describing the OS command injection via unescaped URL in LinkedIn video upload (Infinitsec Blog). No significant vendor statements beyond the GitHub advisory or notable researcher commentary beyond the PoC documentation have been identified.