Vulnerability-Lookup

GHSA-W5FF-2MJC-4PHC

Vulnerability from github – Published: 2026-03-19 12:45 – Updated: 2026-03-25 18:33

Summary

AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

Details

Summary

The uploadVideoToLinkedIn() method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via escapeshellarg(). If an attacker can influence the LinkedIn API response (via MITM, compromised OAuth token, or API compromise), they can inject arbitrary OS commands that execute as the web server user.

Details

The vulnerability exists in plugin/SocialMediaPublisher/Objects/SocialUploader.php.

The initializeLinkedInUploadSession() method (line 649) sends a POST request to https://api.linkedin.com/rest/videos?action=initializeUpload and parses the JSON response at line 693:

// SocialUploader.php:693
$responseArray = json_decode($response, true);

The parsed uploadInstructions array is iterated at line 532, and each uploadUrl is passed to uploadVideoToLinkedIn() at line 542:

// SocialUploader.php:542
$uploadResponse = self::uploadVideoToLinkedIn($instruction['uploadUrl'], $tmpFile);

The uploadVideoToLinkedIn() method (line 711) constructs a shell command by directly concatenating both $uploadUrl and $filePath into a string passed to exec():

// SocialUploader.php:713-720
$shellCmd = 'curl -v -H "Content-Type:application/octet-stream" --upload-file "' .
    $filePath . '" "' .
    $uploadUrl . '" 2>&1';

_error_log("Upload Video Shell Command:\n" . $shellCmd);

exec($shellCmd, $o);

Neither $uploadUrl nor $filePath is sanitized with escapeshellarg(). A malicious URL such as https://uploads.linkedin.local" ; id ; echo " would break out of the quoted string and execute arbitrary commands.

The $uploadUrl originates from LinkedIn's API response — a trusted third-party source over HTTPS — so exploitation requires compromising that response (MITM at CA level, compromised OAuth token leading to attacker-controlled API responses, or LinkedIn API compromise). This makes the attack complexity high, but the missing sanitization is a defense-in-depth failure that could become critical if the trust boundary is ever violated.

PoC

This vulnerability requires manipulating the LinkedIn API response. A simulated proof-of-concept using a local proxy:

Step 1: Set up a proxy that intercepts the LinkedIn API response and replaces the uploadUrl field:

{
  "value": {
    "uploadInstructions": [
      {
        "uploadUrl": "https://example.com\" ; id > /tmp/pwned ; echo \"",
        "firstByte": 0,
        "lastByte": 1024
      }
    ],
    "uploadToken": "token123",
    "video": "urn:li:video:123"
  }
}

Step 2: The resulting shell command becomes:

curl -v -H "Content-Type:application/octet-stream" --upload-file "/tmp/tmpfile" "https://uploads.linkedin.local" ; id > /tmp/pwned ; echo "" 2>&1

Step 3: The id command executes as the web server user, writing output to /tmp/pwned.

Step 4: Verify:

cat /tmp/pwned
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

Impact

Remote Code Execution: If the LinkedIn API response is compromised, an attacker gains arbitrary command execution as the web server user (www-data).
Confidentiality: Full read access to application source code, configuration files (including database credentials), and any data accessible to the web server process.
Integrity: Ability to modify application files, inject backdoors, or alter database records.
Practical risk is low due to the high attack complexity — exploitation requires compromising a trusted HTTPS API response from LinkedIn. This is primarily a defense-in-depth issue.

Recommended Fix

Sanitize both $uploadUrl and $filePath with escapeshellarg() before interpolation into the shell command. Alternatively, replace the exec() call with PHP's native cURL functions (which are already used elsewhere in the same class):

Option 1 — Minimal fix with escapeshellarg():

// plugin/SocialMediaPublisher/Objects/SocialUploader.php:711-715
static function uploadVideoToLinkedIn($uploadUrl, $filePath)
{
    $shellCmd = 'curl -v -H "Content-Type:application/octet-stream" --upload-file ' .
        escapeshellarg($filePath) . ' ' .
        escapeshellarg($uploadUrl) . ' 2>&1';

Option 2 — Replace shell exec with native PHP cURL (preferred):

static function uploadVideoToLinkedIn($uploadUrl, $filePath)
{
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $uploadUrl);
    curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/octet-stream']);
    curl_setopt($ch, CURLOPT_PUT, true);
    curl_setopt($ch, CURLOPT_INFILE, fopen($filePath, 'r'));
    curl_setopt($ch, CURLOPT_INFILESIZE, filesize($filePath));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HEADER, true);
    curl_setopt($ch, CURLOPT_VERBOSE, true);

    $response = curl_exec($ch);
    $headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
    $headers = substr($response, 0, $headerSize);
    curl_close($ch);

    // Extract ETag from response headers
    $matches = [];
    preg_match('/(etag:)(\s?)(.*)(\n)/i', $headers, $matches);
    $etag = isset($matches[3]) ? trim($matches[3]) : null;

    // ... rest of function
}

Option 2 is strongly preferred as it eliminates the shell execution entirely, removing the injection surface and aligning with the PHP cURL usage already present in initializeLinkedInUploadSession() on line 664.

Severity ?

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "25.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33319"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-19T12:45:38Z",
    "nvd_published_at": "2026-03-22T17:17:09Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn\u0027s API response, without sanitization via `escapeshellarg()`. If an attacker can influence the LinkedIn API response (via MITM, compromised OAuth token, or API compromise), they can inject arbitrary OS commands that execute as the web server user.\n\n## Details\n\nThe vulnerability exists in `plugin/SocialMediaPublisher/Objects/SocialUploader.php`.\n\nThe `initializeLinkedInUploadSession()` method (line 649) sends a POST request to `https://api.linkedin.com/rest/videos?action=initializeUpload` and parses the JSON response at line 693:\n\n```php\n// SocialUploader.php:693\n$responseArray = json_decode($response, true);\n```\n\nThe parsed `uploadInstructions` array is iterated at line 532, and each `uploadUrl` is passed to `uploadVideoToLinkedIn()` at line 542:\n\n```php\n// SocialUploader.php:542\n$uploadResponse = self::uploadVideoToLinkedIn($instruction[\u0027uploadUrl\u0027], $tmpFile);\n```\n\nThe `uploadVideoToLinkedIn()` method (line 711) constructs a shell command by directly concatenating both `$uploadUrl` and `$filePath` into a string passed to `exec()`:\n\n```php\n// SocialUploader.php:713-720\n$shellCmd = \u0027curl -v -H \"Content-Type:application/octet-stream\" --upload-file \"\u0027 .\n    $filePath . \u0027\" \"\u0027 .\n    $uploadUrl . \u0027\" 2\u003e\u00261\u0027;\n\n_error_log(\"Upload Video Shell Command:\\n\" . $shellCmd);\n\nexec($shellCmd, $o);\n```\n\nNeither `$uploadUrl` nor `$filePath` is sanitized with `escapeshellarg()`. A malicious URL such as `https://uploads.linkedin.local\" ; id ; echo \"` would break out of the quoted string and execute arbitrary commands.\n\nThe `$uploadUrl` originates from LinkedIn\u0027s API response \u2014 a trusted third-party source over HTTPS \u2014 so exploitation requires compromising that response (MITM at CA level, compromised OAuth token leading to attacker-controlled API responses, or LinkedIn API compromise). This makes the attack complexity high, but the missing sanitization is a defense-in-depth failure that could become critical if the trust boundary is ever violated.\n\n## PoC\n\nThis vulnerability requires manipulating the LinkedIn API response. A simulated proof-of-concept using a local proxy:\n\n**Step 1:** Set up a proxy that intercepts the LinkedIn API response and replaces the `uploadUrl` field:\n\n```json\n{\n  \"value\": {\n    \"uploadInstructions\": [\n      {\n        \"uploadUrl\": \"https://example.com\\\" ; id \u003e /tmp/pwned ; echo \\\"\",\n        \"firstByte\": 0,\n        \"lastByte\": 1024\n      }\n    ],\n    \"uploadToken\": \"token123\",\n    \"video\": \"urn:li:video:123\"\n  }\n}\n```\n\n**Step 2:** The resulting shell command becomes:\n\n```bash\ncurl -v -H \"Content-Type:application/octet-stream\" --upload-file \"/tmp/tmpfile\" \"https://uploads.linkedin.local\" ; id \u003e /tmp/pwned ; echo \"\" 2\u003e\u00261\n```\n\n**Step 3:** The `id` command executes as the web server user, writing output to `/tmp/pwned`.\n\n**Step 4:** Verify:\n\n```bash\ncat /tmp/pwned\n# uid=33(www-data) gid=33(www-data) groups=33(www-data)\n```\n\n## Impact\n\n- **Remote Code Execution:** If the LinkedIn API response is compromised, an attacker gains arbitrary command execution as the web server user (`www-data`).\n- **Confidentiality:** Full read access to application source code, configuration files (including database credentials), and any data accessible to the web server process.\n- **Integrity:** Ability to modify application files, inject backdoors, or alter database records.\n- **Practical risk is low** due to the high attack complexity \u2014 exploitation requires compromising a trusted HTTPS API response from LinkedIn. This is primarily a defense-in-depth issue.\n\n## Recommended Fix\n\nSanitize both `$uploadUrl` and `$filePath` with `escapeshellarg()` before interpolation into the shell command. Alternatively, replace the `exec()` call with PHP\u0027s native cURL functions (which are already used elsewhere in the same class):\n\n**Option 1 \u2014 Minimal fix with `escapeshellarg()`:**\n\n```php\n// plugin/SocialMediaPublisher/Objects/SocialUploader.php:711-715\nstatic function uploadVideoToLinkedIn($uploadUrl, $filePath)\n{\n    $shellCmd = \u0027curl -v -H \"Content-Type:application/octet-stream\" --upload-file \u0027 .\n        escapeshellarg($filePath) . \u0027 \u0027 .\n        escapeshellarg($uploadUrl) . \u0027 2\u003e\u00261\u0027;\n```\n\n**Option 2 \u2014 Replace shell exec with native PHP cURL (preferred):**\n\n```php\nstatic function uploadVideoToLinkedIn($uploadUrl, $filePath)\n{\n    $ch = curl_init();\n    curl_setopt($ch, CURLOPT_URL, $uploadUrl);\n    curl_setopt($ch, CURLOPT_HTTPHEADER, [\u0027Content-Type: application/octet-stream\u0027]);\n    curl_setopt($ch, CURLOPT_PUT, true);\n    curl_setopt($ch, CURLOPT_INFILE, fopen($filePath, \u0027r\u0027));\n    curl_setopt($ch, CURLOPT_INFILESIZE, filesize($filePath));\n    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\n    curl_setopt($ch, CURLOPT_HEADER, true);\n    curl_setopt($ch, CURLOPT_VERBOSE, true);\n\n    $response = curl_exec($ch);\n    $headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);\n    $headers = substr($response, 0, $headerSize);\n    curl_close($ch);\n\n    // Extract ETag from response headers\n    $matches = [];\n    preg_match(\u0027/(etag:)(\\s?)(.*)(\\n)/i\u0027, $headers, $matches);\n    $etag = isset($matches[3]) ? trim($matches[3]) : null;\n\n    // ... rest of function\n}\n```\n\nOption 2 is strongly preferred as it eliminates the shell execution entirely, removing the injection surface and aligning with the PHP cURL usage already present in `initializeLinkedInUploadSession()` on line 664.",
  "id": "GHSA-w5ff-2mjc-4phc",
  "modified": "2026-03-25T18:33:51Z",
  "published": "2026-03-19T12:45:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-w5ff-2mjc-4phc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33319"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/67d932eb05e1bc9b36796f73ff4f9fb47590598b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command"
}

CVE-2026-33319 (GCVE-0-2026-33319)

Vulnerability from cvelistv5 – Published: 2026-03-22 16:29 – Updated: 2026-03-23 11:57

Title

AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

Summary

WWBN AVideo is an open source video platform. Prior to version 26.0, the `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via `escapeshellarg()`. If an attacker can influence the LinkedIn API response (via MITM, compromised OAuth token, or API compromise), they can inject arbitrary OS commands that execute as the web server user. Version 26.0 contains a fix for the issue.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/WWBN/AVideo/security/advisorie…	x_refsource_CONFIRM
	https://github.com/WWBN/AVideo/commit/67d932eb05e…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	WWBN	AVideo	Affected: < 26.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33319",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-23T11:56:47.101273Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-23T11:57:35.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. Prior to version 26.0, the `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn\u0027s API response, without sanitization via `escapeshellarg()`. If an attacker can influence the LinkedIn API response (via MITM, compromised OAuth token, or API compromise), they can inject arbitrary OS commands that execute as the web server user. Version 26.0 contains a fix for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-22T16:29:08.608Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-w5ff-2mjc-4phc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-w5ff-2mjc-4phc"
        },
        {
          "name": "https://github.com/WWBN/AVideo/commit/67d932eb05e1bc9b36796f73ff4f9fb47590598b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WWBN/AVideo/commit/67d932eb05e1bc9b36796f73ff4f9fb47590598b"
        }
      ],
      "source": {
        "advisory": "GHSA-w5ff-2mjc-4phc",
        "discovery": "UNKNOWN"
      },
      "title": "AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33319",
    "datePublished": "2026-03-22T16:29:08.608Z",
    "dateReserved": "2026-03-18T21:23:36.677Z",
    "dateUpdated": "2026-03-23T11:57:35.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-W5FF-2MJC-4PHC

Summary

Details

PoC

Impact

Recommended Fix

CVE-2026-33319 (GCVE-0-2026-33319)

Tags

Sightings

Nomenclature