CVE-2026-61567

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.1.0

Description An unauthenticated remote attacker can achieve operating-system command execution as the web-server user. The issue exists in the live-streaming endpoint view/videosListToLive.php, which accepts an attacker-defined streamer in the webSiteRootURL parameter. The system calls the Login::run() function in objects/Login.php and trusts the returned JSON as session state, allowing an attacker to self-grant isLogged and canStream privileges without valid credentials. This process bypasses the Streamer::isURLAllowed() check and the operator's streamer allowlist. Furthermore, the endpoint accepts playlists id and APISecret values, where the APISecret is forwarded without being verified against a stored secret. The application then fetches a second attacker-controlled video-list response and interpolates videos[].path into ffprobe and ffmpeg commands passed to exec without proper shell argument escaping. The isAudio() function calls isVideo() to trigger the ffprobe command. By using shell delimiters in the paths, an attacker can execute arbitrary commands, potentially disclosing database and streamer credentials, modifying files, establishing persistence, or causing a denial of service for the encoder.

Recommendations Update AVideo to version 8.1.0. As a temporary workaround, restrict access to the view/videosListToLive.php endpoint to minimize the risk of exploitation.