CVE-2025-25286: Crayfish Homarus Remote Code Execution via Authorization Header

Homarus is the Crayfish microservice that wraps FFmpeg for Islandora repositories. Its /convert endpoint passes the Authorization header into the command line it builds for FFmpeg before authentication is enforced.

An attacker who can reach Homarus sends a request with a crafted Authorization header and runs commands on the server. Crayfish 4.1.0 fixes the interpolation. The maintainers also recommend keeping Homarus off the public internet and rejecting requests whose Authorization header fails validation before the CLI step.