CVE-2026-61575

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.1.0

Description An issue exists where the view/queue.php endpoint uses the pathinfo function on the caller-controlled fileURI variable and stores the resulting filename via setTitle in encoder queue.title without proper neutralization. Because fileURI is not included in the objects/security.php filter lists, and the Login::canUpload() capability can be self-granted via an attacker-controlled login site, an attacker can submit a queue entry with a malicious HTML title. This title is subsequently loaded by view/index.php from view/queue.json.php into a jQuery Bootgrid table, where the title formatter concatenates row.title into raw cell HTML. This allows the execution of an event handler in the browser of a privileged viewer, such as an administrator or an operator on the attacker's streamer. The resulting script can access session-visible data and rendered streamer credentials, acting with the privileges of the viewer.

Recommendations Update to version 8.1.0.