CVE-2026-61567: AVideo-Encoder: unauthenticated command execution through streamer login trust
AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant isLogged and canStream without legitimate credentials. The endpoint requires only nonempty playlistsid and APISecret values; APISecret is forwarded rather than checked against a stored secret. This path never calls Streamer::isURLAllowed and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates videos[].path without shell argument escaping into ffprobe and ffmpeg commands passed to exec; isAudio calls isVideo to reach the ffprobe command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideo-Encoderto a version that resolves this vulnerability.Fixed in 8.1.0
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
AVideo-Encoder versions prior to 8.1.0 are exposed if an attacker can operate an HTTP service reachable by the encoder. The attack does not depend on the operator's streamer allowlist because this endpoint does not call Streamer::isURLAllowed.
Does exploitation require valid AVideo credentials or knowledge of a configured API secret?
No. An attacker can supply a streamer-controlled webSiteRootURL whose login response grants isLogged and canStream, and the endpoint only requires nonempty playlists_id and APISecret values. The supplied APISecret is forwarded rather than validated against a stored secret.
What level of access can an attacker obtain?
An attacker can execute arbitrary operating-system commands as the web-server user through shell delimiters in a video-list response path processed by ffprobe or ffmpeg. This may disclose database and stored streamer credentials, enable compromise of the upstream platform using those credentials, and allow modification of the affected system.
Can request filtering block the described command-injection payload?
The request filter does not inspect the attacker-controlled video-list JSON containing videos[].path. That path reaches commands passed to exec without shell argument escaping.