GHSA-pq8p-wc4f-vg7j

### Summary The incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget but leaves the `file_get_contents` and `curl` code paths unsanitized, and the URL validation regex `/^http/` accepts strings like `httpevil.com`. ### Affected Package - **Ecosystem:** Other - **Package:** AVideo - **Affected versions:** < commit 1e6cf03e93b5 - **Patched versions:** >= commit 1e6cf03e93b5 ### Details The vulnerable `wget()` function in `plugin/Live/test.php`: ```php function wget($url, $filename) { $cmd = "wget --tries=1 {$url} -O {$filename} --no-check-certificate"; exec($cmd); } ``` Neither `$url` nor `$filename` is passed through `escapeshellarg()`. The URL validation uses `preg_match("/^http/", $url)` which: - Does not require `://` (matches `httpevil.com`) - Does not block shell metacharacters (`;`, backticks, `$()`) - Does not validate the URL is actually a URL A payload like `http://x; id > /tmp/pwned; echo ` passes the regex and injects arbitrary commands via the semicolons. The fix adds `escapeshellarg()` for the wget path and an `isAllowedStatsTestURL` allowlist, but `url_get_contents()` (used by the same endpoint) still follows redirects without validation. The wget-specific fix does not protect the `file_get_contents` and `curl` code paths that handle the same user-supplied URL. ### PoC ```python """ CVE-2026-33502 - Command injection in AVideo plugin/Live/test.php Tests REAL vulnerable code from: plugin/Live/test.php (commit pre-1e6cf03) The vulnerable wget() function at the end of test.php: $cmd = "wget --tries=1 {$url} -O {$filename} --no-check-certificate"; exec($cmd); No escapeshellarg() is used on $url or $filename parameters. The URL validation regex /^http/ is also weak (matches "httpevil.com"). """ import re import sys import os import subprocess src_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'src') src_content = open(os.path.join(src_dir, 'test.php')).read() print("=" * 60) print("CVE-2026-3350