CVE-2026-33648 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a command injection caused by unsanitized user-controlled 'users_id' and 'liveTransmitionHistory_id' in restreamer endpoint, letting authenticated users execute arbitrary commands via shell metacharacters.

Severity & Score

Impact

Authenticated users can execute arbitrary commands on the server, potentially leading to full server compromise.

Mitigation

Update to a version including commit 99b865413172045fef6a98b5e9bfc7b24da11678 or later.

References

• https://github.com/WWBN/AVideo/commit/99b865413172045fef6a98b5e9bfc7b24da11678
• https://github.com/WWBN/AVideo/security/advisories/GHSA-5m4q-5cvx-36mw

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 23, 2026

🟠 CVE-2026-33648 - High (8.8) WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a log file path by embedding user-controlled `users_id` and `liveTransmitionHistory_id` values from the JSON request body withou... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33648/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner