5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-w5ff-2mjc-4phc

GHSA-w5ff-2mjc-4phc: AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

Summary

The uploadVideoToLinkedIn() method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via escapeshellarg(). If an attacker can influence the LinkedIn API response (via MITM, compromised OAuth token, or API compromise), they can inject arbitrary OS commands that execute as the web server user.

Details

The vulnerability exists in plugin/SocialMediaPublisher/Objects/SocialUploader.php.

The initializeLinkedInUploadSession() method (line 649) sends a POST request to https://api.linkedin.com/rest/videos?action=initializeUpload and parses the JSON response at line 693:

// SocialUploader.php:693
$responseArray = json_decode($response, true);

The parsed uploadInstructions array is iterated at line 532, and each uploadUrl is passed to uploadVideoToLinkedIn() at line 542:

// SocialUploader.php:542
$uploadResponse = self::uploadVideoToLinkedIn($instruction['uploadUrl'], $tmpFile);

The uploadVideoToLinkedIn() method (line 711) constructs a shell command by directly concatenating both $uploadUrl and $filePath into a string passed to exec():

// SocialUploader.php:713-720
$shellCmd = 'curl -v -H "Content-Type:application/octet-stream" --upload-file "' .
    $filePath . '" "' .
    $uploadUrl . '" 2>&1';

_error_log("Upload Video Shell Command:\n" . $shellCmd);

exec($shellCmd, $o);

Neither $uploadUrl nor $filePath is sanitized with escapeshellarg(). A malicious URL such as https://uploads.linkedin.local" ; id ; echo " would break out of the quoted string and execute arbitrary commands.

The $uploadUrl originates from LinkedIn's API response — a trusted third-party source over HTTPS — so exploitation requires compromising that response (MITM at CA level, compromised OAuth token leading to attacker-controlled API responses, or LinkedIn API compromise). This makes the attack complexity high, but the missing sanitization is a defense-in-depth failure that could become critical if the trust boundary is ever violated.

Miggo Vulnerability Database

→

GHSA-w5ff-2mjc-4phc

GHSA-w5ff-2mjc-4phc:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wwbn/avideo	composer	<= 25.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.9

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-w5ff-2mjc-4phc: AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

Summary

Details

GHSA-w5ff-2mjc-4phc:

5.9

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Technical Details

Basic Information

Basic Information

5.9

5.9

Vulnerability Intelligence
Miggo AI

GHSA-w5ff-2mjc-4phc: AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

Summary

Details

PoC

Impact

Recommended Fix

5.9

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-w5ff-2mjc-4phc: AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

Summary

Details

GHSA-w5ff-2mjc-4phc:

5.9

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Basic Information

Basic Information

5.9

5.9

Vulnerability IntelligenceMiggo AI

GHSA-w5ff-2mjc-4phc: AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

Summary

Details

PoC

Impact

Recommended Fix

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI