Command Injection Affecting wwbn/avideo package, versions <26.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-WWBNAVIDEO-15758899
- published23 Mar 2026
- disclosed19 Mar 2026
- creditrestriction
Introduced: 19 Mar 2026
CVE NOT AVAILABLE CWE-78 (opens in a new tab)How to fix?
Upgrade wwbn/avideo to version 26.0 or higher.
Overview
wwbn/avideo is an Audio and Video Platform or simply "A Video Platform".
Affected versions of this package are vulnerable to Command Injection in the uploadVideoToLinkedIn function when constructing a shell command using unsanitized input from a third-party API response. An attacker can execute arbitrary operating system commands as the web server user by manipulating the API response to inject malicious content into the uploadUrl parameter.
Note: This is only exploitable if the attacker can compromise the integrity of the LinkedIn API response, such as through a man-in-the-middle attack at the certificate authority level, a compromised OAuth token, or a breach of the LinkedIn API itself.
Workaround
This vulnerability can be mitigated by sanitizing both the file path and upload URL with escapeshellarg() before passing them to the shell command, or by replacing the shell execution with PHP's native cURL functions.