AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
Date: 2026-03
Affected: composer/wwbn/avideo
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33648
CWE: CWE-78
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

## Summary The restreamer endpoint constructs a log file path by embedding user-controlled `users_id` and `liveTransmitionHistory_id` values from the JSON request body without any sanitization. This log file path is then concatenated directly into shell commands passed to `exec()`, allowing an authenticated user to achieve arbitrary command execution on the server via shell metacharacters such as `$()` or backticks. ## Details The vulnerability exists in `plugin/Live/standAloneFiles/restreamer.json.php`. The data flow is: **1. User input ingestion** (line 220): ```php $request = file_get_contents("php://input"); $robj = json_decode($request); ``` **2. Log file template** (line 58): ```php $logFile = $logFileLocation . "ffmpeg_restreamer_{users_id}_" . date("Y-m-d-h-i-s") . ".log"; ``` **3. `users_id` injected without sanitization** (line 318): ```php $obj->logFile = str_replace('{users_id}', $robj->users_id, $logFile); ``` **4. `liveTransmitionHistory_id` injected without sanitization** (line 407): ```php $pid[] = startRestream($m3u8, [$value], str_replace(".log", "_{$key}_{$robj->liveTransmitionHistory_id}_{$host}.log", $logFile), $robj); ``` Note: `intval()` is applied to `liveTransmitionHistory_id` in the separate `getProcess()` function (line 805), but NOT in the `runRestream()` path that constructs the log file. **5. Unsanitized log file path passed to `exec()`** (lines 720, 723): ```php // Line 720 (remote ffmpeg path): execFFMPEGAsyncOrRemote($command . ' > '


Mitigations:

Architectural layers (MAESTRO):