AVideo Flaws Enable Remote Code Execution via Command Injection and Malicious Plugin Upload

WWBN AVideo versions up to and including 26.0 are affected by two high-severity flaws that can lead to remote code execution. CVE-2026-33482 is an OS command injection bug in sanitizeFFmpegCommand(), which strips some shell metacharacters but fails to remove bash command substitution using $(). Because the resulting ffmpeg command is later executed in a double-quoted sh -c context by execAsync(), an attacker able to craft a valid encrypted payload can run arbitrary commands on the standalone encoder server.

A separate issue, CVE-2026-33507, allows unauthenticated code execution through the plugin import workflow. The objects/pluginImport.json.php endpoint permits admin users to upload and install plugin ZIP archives containing executable PHP, but lacks CSRF protection; with session.cookie_samesite = 'None' on HTTPS connections, an attacker can trick a logged-in administrator into silently importing a malicious plugin and deploying a PHP webshell. Fixes were introduced in commits 25c8ab90269e3a01fb4cf205b40a373487f022e1 and d1bc1695edd9ad4468a48cea0df6cd943a2635f3.