PT-2026-27170 · Avideo · Avideo

Restriction · Publicado 2026-03-23 · Atualizado 2026-03-25 · CVE-2026-33648

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The restreamer endpoint constructs a log file path by embedding user-controlled users id and liveTransmitionHistory id values from the JSON request body without sanitization. This log file path is then concatenated directly into shell commands passed to the exec() function, allowing an authenticated user to achieve arbitrary command execution on the server via shell metacharacters such as $() or backticks. The vulnerability lies in the improper handling of user-supplied input when constructing shell commands.

Recommendations Update to Commit 99b865413172045fef6a98b5e9bfc7b24da11678.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-33648

GHSA-5M4Q-5CVX-36MW

Produtos afetados

Avideo

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33648.json · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/commit/99b865413172045fef6a98b5e9bfc7b24da11678 · Correção
• https://github.com/WWBN/AVideo/security/advisories/GHSA-5m4q-5cvx-36mw · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2036178863810617753 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33648 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2036173333981692248 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33648 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-5m4q-5cvx-36mw · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2036166843442860241 · Publicação no Twitter