CVE-2026-61571

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.1.0

Description The encoder lacks a global authentication layer, exposing several PHP endpoints to anonymous network callers. The endpoint 'view/run.php' invokes the Encoder::run() function. The endpoint 'view/queue.json.php' calls Encoder::getAll(true), reveals streamer URLs via getSiteURL(), and triggers processing through execRun(). The endpoint 'view/status.php' returns a wildcard Access-Control-Allow-Origin header, reads the queue, triggers processing, and exposes host memory statistics through ServerMonitor::getMemory() when serverStatus is enabled. Additionally, the endpoint 'view/listFiles.json.php' allows anonymous access when disableBulkEncode is empty, using the path parameter with realpath() and scandir() without base-directory restrictions. This allows an unauthenticated attacker to control the privileged queue processor, access queue and streamer-site information, obtain memory statistics, and enumerate media file names and paths in directories readable by the web-server user, limited to configured media extensions.

Recommendations Update to version 8.1.0.