CVE-2026-61564: AVideo-Encoder: unauthenticated installer PHP code injection
AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires videos/configuration.php to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied systemRootPath must contain index.php and a connection using databaseHost, databaseUser, and databasePass must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from systemRootPath without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideo-Encoderto a version that resolves this vulnerability.Fixed in 8.1.0
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Fresh deployments are exposed while videos/configuration.php is absent. The installer endpoint is blocked when that file already exists, but exposure returns if the file is removed or moved.
Does an attacker need an account or valid target database credentials?
No. The endpoint is unauthenticated, and the attacker can supply connection parameters for a database server they control rather than using target credentials.
What conditions must an attacker satisfy?
The supplied systemRootPath must contain index.php, and the supplied databaseHost, databaseUser, and databasePass must establish a successful database connection. The attacker can choose these supplied values, including a database server under their control.
What can be done if the update cannot be applied immediately?
Ensure videos/configuration.php exists and is not removed or moved, because its presence blocks this installer endpoint. Restricting access to the unauthenticated installer endpoint is also implied by the affected attack path, but no specific configuration workaround is provided.
How can administrators identify a potentially affected installation?
Check whether the installation is prior to 8.1.0 and whether videos/configuration.php is absent. Also review whether the installer endpoint install/checkConfiguration.php is reachable and whether the configuration file was recently removed or moved.