Merge pull request #17685 from jellyfin/GHSA-wwwm-px48-fpvq-v12

Fix GHSA-wwwm-px48-fpvq

1 files changed, 2 insertions, 3 deletions

diff --git a/MediaBrowser.MediaEncoding/Attachments/AttachmentExtractor.cs b/MediaBrowser.MediaEncoding/Attachments/AttachmentExtractor.cs
index 12a5ab877c..fbe8afc66e 100644
--- a/MediaBrowser.MediaEncoding/Attachments/AttachmentExtractor.cs
+++ b/MediaBrowser.MediaEncoding/Attachments/AttachmentExtractor.cs
@@ -14,7 +14,6 @@ using MediaBrowser.Controller.Entities;
 using MediaBrowser.Controller.IO;
 using MediaBrowser.Controller.Library;
 using MediaBrowser.Controller.MediaEncoding;
-using MediaBrowser.MediaEncoding.Encoder;
 using MediaBrowser.Model.Dto;
 using MediaBrowser.Model.Entities;
 using MediaBrowser.Model.IO;
@@ -160,7 +159,7 @@ namespace MediaBrowser.MediaEncoding.Attachments
                         CultureInfo.InvariantCulture,
                         "-dump_attachment:{0} \"{1}\" ",
                         attachment.Index,
-                        EncodingUtils.NormalizePath(attachmentPath));
+                        attachmentPath.EscapeProcessArgument());
                     missingPaths.Add(attachmentPath);
                 }
 
@@ -425,7 +424,7 @@ namespace MediaBrowser.MediaEncoding.Attachments
                 "-dump_attachment:{1} \"{2}\" -i {0} {3}",
                 inputPath,
                 attachmentStreamIndex,
-                EncodingUtils.NormalizePath(outputPath),
+                outputPath.EscapeProcessArgument(),
                 hasVideoOrAudioStream ? "-t 0 -f null null" : string.Empty);
 
             int exitCode;