The standalone FFmpeg execution endpoint "plugin/API/standAlone/ffmpeg.json.php" builds a shell command string that is passed to "execAsync()" and run via "nohup sh -c "<command>"". When the decrypted "codeToExec" payload produces a non-empty "avideoPath", the endpoint appends a completion hook of the form: The "notify" value on this line is wrapped with "escapeshellarg()", but the two adjacent fields "notifyCode" and "callback" are concatenated raw. Both fields originate from the same decrypted, attacker-controlled "codeToExec" object as "ffmpegCommand", but neither passes through the "sanitizeFFmpegCommand()" denylist (only "ffmpegCommand" does) and neither is shell-escaped. An attacker who can craft a valid encrypted payload can therefore inject arbitrary shell commands into the "sh -c" context by placing shell metacharacters in "callback" or "notifyCode", achieving OS command execution as the web-server user. This is a residual sibling of the recently hardened "sanitizeFFmpegCommand()" denylist: the denylist now strips "; | " < > & $ ( ) \n \r { }"from"ffmpegCommand", but the two sibling fields on the same completion-hook line were never routed through it nor escaped, even though the "notify` value beside them on the very same line already is escaped.