What it is
AVideo installations often sit directly on public media-upload and publishing workflows. When the deployed package is in the affected range, a feature intended to embed remote video links can become a host-level command-execution concern.
How it happens
CVE-2023-25313 is an OS command injection in AVideo's remote video-link embedding, fixed in AVideo 12.4. A crafted video link can reach a command that the server runs, so anyone allowed to embed or import a link can run commands on the AVideo host.
What an attacker gets
A vulnerable AVideo service can put the PHP host, media files, encoder workers, and adjacent application credentials at risk depending on how the installation is deployed and who can reach video-link embedding features.
// what fixvibe reports
What FixVibe reports
Runs when you connect a GitHub repository, on Pro and above. Each finding shows the file and line, its severity and fix steps you can paste into your AI coding tool.
How to fix it
Upgrade `wwbn/avideo` to 12.4 or newer, regenerate `composer.lock`, and redeploy the patched AVideo host or container. Keep upload, import, and video-link embedding features limited to trusted users while rollout completes, and review logs if the affected installation was internet-facing.