Attack Chain

1. An authenticated attacker sends a crafted POST request to the /restreamer endpoint.
2. The attacker injects shell metacharacters (e.g., $(), backticks) into the users_id and/or liveTransmitionHistory_id parameters within the JSON request body.
3. The AVideo application receives the request and constructs a log file path using the unsanitized input.
4. The application concatenates the malicious log file path into a shell command string.
5. The exec() function executes the crafted shell command on the server.
6. The injected shell metacharacters trigger the execution of arbitrary commands on the system.
7. The attacker achieves remote code execution, potentially leading to system compromise.
8. The attacker can then install malware, exfiltrate data, or pivot to other systems.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the AVideo server. This can lead to complete system compromise, including data theft, malware installation, and denial of service. The specific number of affected AVideo instances is unknown, but given its open-source nature, the potential impact is significant if unpatched instances are exposed to the internet. This could affect any organization that uses AVideo as a video platform.

Recommendation

• Upgrade AVideo installations to a patched version that includes commit 99b865413172045fef6a98b5e9bfc7b24da11678 to remediate CVE-2026-33648.
• Implement input validation and sanitization on the /restreamer endpoint to prevent shell metacharacter injection, mitigating CVE-2026-33648.
• Deploy the Sigma rule Detect AVideo Restreamer RCE Attempt to identify exploitation attempts in web server logs.
• Monitor web server logs for suspicious POST requests to /restreamer containing shell metacharacters in the request body to identify potential exploitation attempts, helping to mitigate CVE-2026-33648.