Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| WWBN/AVideo | composer | <= 29.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a command injection flaw in the on_publish.php script of the AVideo Live plugin. The script constructs a shell command by concatenating user-controlled variables, such as the m3u8 URL, without proper escaping. The $m3u8 variable, generated by the Live::getM3U8File function, can be manipulated by an attacker by providing a malicious stream key. This allows an attacker to inject shell metacharacters, like single quotes, to break out of the intended command and execute arbitrary commands on the server. The execAsync function is the sink that executes the crafted command. The vulnerability can be triggered by a user with streaming permissions via a direct POST request to the on_publish.php endpoint. The recommended fix is to use the escapeshellarg() function to properly sanitize all variables before they are used to construct the command.
on_publish.phpplugin/Live/on_publish.php
Live::getM3U8Fileplugin/Live/Live.php
execAsyncplugin/Live/on_publish.php