CVE-2023-25313 — Vulnerability in wwbn/avideo — CVE Details

CRITICAL

AVideo contains Command injection when embedding a video link

Published February 2, 2023Updated July 8, 2026Source: osv

Summary

Impact: An attacker could execute remote code on a system running wwbn/avideo Step to Reproduce: 1. Go to the `My Videos` tab https://demo.avideo.com/mvideos 2. Click "Embed a video link" Append a command to the url as a query string. eg. `?whoami` then click Save This issue has been resolved in commit `236228f15`

Advisory Timeline

First published February 2, 2023 (1348 days ago).
Last revised July 8, 2026 — 1252 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer

Update wwbn/avideo to 12.4 or later

composer require "wwbn/avideo:^12.4"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

Package	Ecosystem	Affected	Fixed In
wwbn/avideo	packagist	10.4, 10.8, 11, 11.1 (+3 more)	12.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-79
Cross-site Scripting (XSS)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.6 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-25313?: AVideo contains Command injection when embedding a video link This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.6/10).
How do I check if my project is affected by CVE-2023-25313?: CVE-2023-25313 affects wwbn/avideo. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-25313 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.6

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-pgvh-p3g4-86jw

Related CVEs

CVE-2026-54458
CRITICAL
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
CVE-2026-33716
CRITICAL
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
CVE-2026-29058
CRITICAL
WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php
CVE-2026-40909
HIGH
WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
CVE-2026-33513
HIGH
AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
CVE-2026-33717
HIGH
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL
CVE-2026-33039
HIGH
AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
CVE-2026-60092
MEDIUM
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies