The use of Process::fromShellCommandline() in this FFmpeg integration isn't evidence of a developer ignoring security — it's evidence of someone who understood the risk and reached for the right API, but placed the dangerous operation entirely outside its protection boundary. That's the critical detail: the filename interpolation happens before that call, so the attack string never reaches what the developer believed was their protection layer. The slugify() sanitizer running afterward makes this worse, not better — it's a display/URL utility that was never designed to provide security, likely added reactively during a code review or after a static-analysis warning, without anyone tracing that the dangerous interpolation already happened upstream.
The core failure is architectural: the authentication gate requires a valid user, but performs no input validation before passing data to a system command executor. The assets/upload permission checks whether the user clicked the right button — it doesn't check whether what flows through it will reach a shell. This isn't a permission failure; it's a boundary failure where authentication was designed as a user-facing gatekeeper rather than a data-flow guard.
Two concrete actions: First, audit other Cockpit modules for the same pattern — input validation happening after command construction, or permission checks that don't trace to the actual execution path. Second, review any use of slugify() or similar display utilities in file-handling code; if they're positioned between user input and system calls, they're being misapplied as security controls. The fix requires parameterized commands via Process::from() with explicit argument arrays, not input sanitization at the display layer.