CVE-2026-61564

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.1.0

Description An unauthenticated installer endpoint install/checkConfiguration.php fails to escape request parameters, such as webSiteRootURL, when interpolating them into single-quoted PHP string literals to create the videos/configuration.php file. This allows an attacker to inject PHP code that executes as the web-server user when the generated file is accessed. This is possible if videos/configuration.php is absent, which occurs during fresh deployments or after the file is removed. The attacker can control the systemRootPath to write files, read or overwrite files owned by the web-server user, and establish persistent PHP code. Additionally, the endpoint interpolates request values into streamer and configuration INSERT statements, resulting in a secondary SQL injection sink.

Recommendations Update to version 8.1.0.