CVE-2022-30534: WWBN AVideo aVideoEncoder chunkfile OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote OS command injection with high impact and a very high EPSS score, though exploitation requires a low-privileged account and no KEV listing exists.

What it is

AVideo 11.6 and dev master commit 3f7c0364 contain an OS command injection flaw in the aVideoEncoder chunkfile functionality. A specially crafted HTTP request can cause arbitrary command execution on the server. Because the encoder handles media processing, this is a remotely reachable flaw in a core feature of the platform.

Impact

An authenticated attacker can execute arbitrary operating system commands on the AVideo host, leading to full compromise of confidentiality, integrity and availability of the server and any data it holds.

Attack surface

Reached over the network via an HTTP request to the aVideoEncoder chunkfile endpoint. The CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N), so a valid low-privileged account is enough.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high at 0.74979 (99.48th percentile), indicating strong predicted exploitation activity; references are technical advisories only, with no public exploit tag.

What to do

• Upgrade AVideo to a version that fixes the aVideoEncoder chunkfile command injection; apply the vendor patch referenced in the Talos advisory first.
• If patching is not immediately possible, restrict or disable the aVideoEncoder chunkfile functionality and block access to the affected endpoint.
• Enforce least privilege on AVideo accounts and remove or disable unused low-privileged accounts that could reach the encoder.
• Run the AVideo service under a low-privilege OS account with no shell access and restrict outbound network access from the host.
• Place the AVideo instance behind a WAF or reverse proxy that filters command-injection patterns in encoder requests.

Detection

• Monitor AVideo web and application logs for requests to the aVideoEncoder chunkfile endpoint containing shell metacharacters or unexpected parameters.
• Alert on child processes spawned by the web server or PHP process (for example sh, bash, curl, wget) that are not part of normal media encoding.
• Review process accounting or EDR telemetry for command execution originating from the AVideo service account.
• Baseline normal encoder traffic and flag anomalous request rates or payload sizes to that endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.