Language: PHP
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
	private function thumbVideo($file,$cacheFile,$videoThumbTime){
		$command = $this->getFFmpeg();
		if(!$command){
			echo "Ffmpeg ".LNG("fileThumb.check.notFound");
			return false;
		}
		$tempPath = $cacheFile;
		if($GLOBALS['config']['systemOS'] == 'linux' && is_writable('/tmp/')){
			mk_dir('/tmp/fileThumb');
			$tempPath = '/tmp/fileThumb/'.rand_string(15).'.jpg';
		}

		$maxWidth = 800;
		$timeAt   = $videoThumbTime ? '-ss 00:00:03' : '';
		$script   = $command.' -i "'.$file.'" -y -f image2 '.$timeAt.' -vframes 1 '.$tempPath.' 2>&1';
		$out = shell_exec($script);
		if(!file_exists($tempPath)) {
			if ($this->thumbVideoByLink($cacheFile)) return;
			return $this->log('video thumb error,'.$out.';cmd='.$script);
		}

		move_path($tempPath,$cacheFile);
		$cm = new ImageThumb($cacheFile,'file');
		$cm->prorate($cacheFile,$maxWidth,$maxWidth);
	}