CVE-2026-45578: WWBN AVideo Command Injection – RCE via Live Streaming

Technical summary

CVE-2026-45578 is a shell metacharacter injection vulnerability (CWE-78) in WWBN AVideo version 29.0 and earlier. The YPTSocket notification handler in plugin/Live/on_publish.php constructs an execAsync() command by string concatenation, single-quoting each argument ($users_id, $m3u8, $obj->liveTransmitionHistory_id) but neglecting to call escapeshellarg(). An attacker who can control any of these three parameters can terminate the quoted token with a single quote and append arbitrary shell commands that will execute with the privileges of the web server process.

Business impact

Successful exploitation grants an authenticated attacker remote code execution on affected servers. An attacker with valid credentials—such as a live streamer or privileged user—can compromise the entire server, access sensitive streaming data, manipulate broadcast content, establish persistence, or pivot to other systems on the network. For platforms hosting user-generated video content, this represents a severe data confidentiality and integrity risk.

Affected systems

WWBN AVideo version 29.0 and earlier are vulnerable. Organizations running self-hosted AVideo instances should inventory their deployments and determine current version levels immediately.

Exploitability

Exploitation requires authentication (PR:L in the CVSS vector), reducing opportunistic attack surface but not eliminating risk. The vulnerability is trivial to exploit once an attacker gains valid credentials—no complex exploitation technique is required, only string injection. The attack is over the network and does not require user interaction.

Remediation

Upgrade WWBN AVideo to a patched version released after the vulnerability disclosure. Verify the specific version number against the vendor's official advisory and release notes. As an interim measure, restrict access to live streaming features to trusted users, apply network segmentation to limit access to AVideo servers, and monitor for suspicious shell command patterns in application logs.

Patch guidance

Check the official WWBN AVideo repository and release announcements for version 30.0 or later, which should include fixes for this command injection. Apply patches to all instances running version 29.0 or earlier. Test patches in a staging environment before production deployment to ensure compatibility with existing configurations and extensions.

Detection guidance

Monitor application logs and system audit logs for unusual execAsync() calls originating from the on_publish.php handler. Look for single-quote characters in livestream user IDs, m3u8 parameters, or transmission history IDs followed by shell metacharacters (e.g., backticks, $(), pipe, semicolon, ampersand). Correlate suspicious log entries with authentication events to identify compromised accounts. Web application firewalls (WAF) can be configured to detect and block requests containing shell metacharacters in these specific parameters.

Why prioritize this

This vulnerability merits urgent patching despite not yet appearing on the CISA KEV list. The combination of a high CVSS score (8.8), straightforward exploitation, and powerful impact (remote code execution) makes it attractive to opportunistic attackers. Authentication requirement provides a modest control, but legitimate credentials can be compromised or misused. Prioritize patching internet-facing AVideo instances above internal deployments, and prioritize any instances processing sensitive or regulated video content.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high severity: the vulnerability grants an authenticated attacker complete control over confidentiality, integrity, and availability of the affected system (C:H/I:H/A:H). The network-accessible attack vector (AV:N) and low complexity (AC:L) mean that weaponization is trivial. The presence of an authentication requirement (PR:L) prevents completely unauthenticated exploitation, preventing the score from reaching critical (9.0+) but does not materially reduce real-world risk in environments where user credentials are shared, reused, or otherwise compromised.

Frequently asked questions