The helper "listFFmpegProcesses($keyword)" in "plugin/API/standAlone/functions.php" builds a shell pipeline by interpolating "$keyword" inside single quotes and running it with "exec()": The two callers in "plugin/API/standAlone/ffmpeg.json.php" (the "list" mode and the "isKeywordRunning" mode) pass the RAW decrypted "codeToExec" field, not the sanitized "$keyword" variable that the endpoint allowlists elsewhere. Because the value is placed inside a single-quoted shell context with no escaping, a payload that closes the quote (for example "x'; touch /tmp/marker #") breaks out and injects an arbitrary command that runs via "exec()"'s "/bin/sh -c". An attacker who can craft a valid encrypted payload achieves OS command execution as the web-server user.