CVE-2026-61564 is an unusually direct route from a first-run setup page to code execution. In AVideo-Encoder versions before 8.1.0, an unauthenticated request to the installer can cause the application to write attacker-supplied PHP into its own configuration file, then run it when that file is requested.
AVideo is an open-source, self-hosted video-sharing and broadcasting platform. Its separate Encoder service takes uploaded or imported media, queues transcoding with FFmpeg, creates formats such as HLS, MP4, WebM and MP3, and sends the results back to AVideo streamer sites. It is run by operators who choose dedicated, private encoding capacity rather than a public service—often because their media and processing sit on private infrastructure. The vendor does not publish a reliable customer or sector breakdown, so named industries and organisations cannot be confirmed.
A missing config file opens the installer
The affected endpoint, install/checkConfiguration.php, is reachable without a login when videos/configuration.php does not exist. That is expected on a fresh deployment, but it can also occur if the file has been removed or moved. An existing configuration file blocks this particular installer path.
The installer builds videos/configuration.php as PHP source and placed request values, including webSiteRootURL, directly inside single-quoted PHP strings. A quote in an input ends the intended string; the rest of the input can become PHP the server executes. The vendor advisory shows a complete anonymous proof of concept, including the subsequent request that executes an operating-system command. It was present when that advisory was published on June 22, 2026; the later November 3 classification reflects exploit-reference enrichment, not the first appearance of the PoC.
An attacker must supply a systemRootPath containing index.php and make the supplied database connection succeed. Those are constraints, not meaningful target authentication: the attacker can point the connection fields at a database server they control. The path itself was also attacker-controlled without a base-directory restriction. The result is code execution as the web-server user, with the ability to read or overwrite files that user owns, leave persistent PHP behind, and control stored database settings. Two SQL INSERT operations create an additional SQL-injection sink.
Public exploit, not confirmed victim activity
A public PoC exists, but there is no confirmed evidence of exploitation in the wild as of November 3, 2026: no reported victims, campaign, actor, malware linkage or published indicators of compromise. CISA’s enrichment marks exploitation as poc, which means proof-of-concept material exists rather than observed operational use. The vulnerability is also absent from CISA’s KEV data; it is not a Known Exploited Vulnerabilities listing.
That distinction should not soften the response. The preconditions are common enough for exposed new installations, and the proof of concept removes much of the work an attacker would otherwise need to do.
Upgrade, then investigate exposed instances
Version 8.1.0 fixes the issue. The source patch constrains the installation path, uses var_export rather than interpolating values into PHP literals, validates the database name, and moves the affected SQL work to prepared statements. The vendor advisory’s patched-version field still says “None,” but the later CVE record identifies 8.1.0 as the fix; the patch and release support that conclusion.
Upgrade every Encoder instance below 8.1.0, and do not leave the installer reachable on internet-facing hosts. Before treating an exposed fresh or reconfigured deployment as clean, inspect videos/configuration.php, web-server logs and file changes for injected PHP, unexpected connection settings and follow-on activity; rotate credentials if that review raises doubt. In practice, assume exposure may have become compromise until the investigation says otherwise, and use SecAlerts to monitor the software an organisation actually runs for newly relevant vulnerabilities.
