The hook
AVideo installations often sit directly on public media-upload and publishing workflows. When the deployed package is in the affected range, a feature intended to embed remote video links can become a host-level command-execution concern.
How it works
This active check confirms whether user-controlled input or workflow behavior crosses a security boundary. Public docs keep the explanation high-level so customers understand the risk. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
The blast radius
A vulnerable AVideo service can put the PHP host, media files, encoder workers, and adjacent application credentials at risk depending on how the installation is deployed and who can reach video-link embedding features.
// what fixvibe checks
What FixVibe checks
FixVibe checks this class with verified-domain active testing that is bounded, non-destructive, and evidence-driven. Public reports describe the affected surface and remediation. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Upgrade `wwbn/avideo` to 12.4 or newer, regenerate `composer.lock`, and redeploy the patched AVideo host or container. Keep upload, import, and video-link embedding features limited to trusted users while rollout completes, and review logs if the affected installation was internet-facing.