CVE-2023-32073 AVideo command injection vulnerability

What is CVE-2023-32073?

CVE-2023-32073 is a high-severity command injection vulnerability in Wwbn Avideo, published on 12 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.

Weakness: CWE-77

Which versions are affected by CVE-2023-32073?

2 open source packages ship an affected version, including wwbn/avideo. It affects 1 product.

Products include Wwbn Avideo.

How do I fix CVE-2023-32073?

No fix has been published for CVE-2023-32073 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-32073 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-32073 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Wwbn Avideo

• CVE-2026-40911 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks Critical 10.0
• CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection Critical 10.0
• CVE-2022-30534 Command injection in AVideo Critical 9.9
• CVE-2022-30547 Path traversal in AVideo Critical 9.9
• CVE-2022-32572 Command injection in AVideo Critical 9.9

All Wwbn Avideo vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2mhh-27v7-3vcx.