CVE-2026-61572

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.1.0

Description An unauthenticated remote attacker can read internal HTTP and HTTPS responses, including cloud instance-metadata credentials, and reach internal TCP services. The issue exists because the url get contents function in objects/functions.php accepts caller-controlled destinations after only syntax validation, failing to reject private, loopback, or link-local addresses and disabling TLS peer verification. The unauthenticated 'objects/login.json.php' endpoint returns a session object containing the raw fetched body, enabling full-response exfiltration via a supplied siteURL. Additionally, a pre-authentication variant in 'view/youtubeDl.json.php' routes an ftp videoURL into FTPDownloader, where the parseFtpUrl function in objects/FTPDownloader.php accepts the host and port for ftp connect, allowing requests to internal FTP services. Untrusted self-signed HTTPS certificates are also accepted.

Recommendations Update to a version later than 8.1.0 to resolve the internal-network and TLS issues, as version 8.1.0 only provided a partial remediation.