{"id":"CVE-2026-61564","kind":"vulnerability","aliases":["CVE-2026-61564"],"related":[],"title":"AVideo: unauthenticated installer writes PHP config, enabling remote code execution","description":"AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php and a connection using `databaseHost`, `databaseUser`, and `databasePass` must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from `systemRootPath` without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.","summary":"The unauthenticated installer endpoint install/checkConfiguration.php writes videos/configuration.php from request parameters without escaping, so an attacker can inject PHP that runs when the file loads. The same endpoint also has a SQL injection sink and can be pointed at an attacker-controlled database.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avideo","package","php","self-hosted","video-platform"],"not_affected_if":["configuration-file-present","version-8.1.0-or-later"],"how_to_check":"- Check the installed AVideo version; versions before `8.1.0` are affected.\n- Check whether `videos/configuration.php` is absent on the server, since the flaw requires it to be missing (for example on a fresh deployment).\n- Check whether `install/checkConfiguration.php` is reachable from the internet.","fix":"- Upgrade AVideo to `8.1.0` or later.\n- Until upgraded, block or remove access to `install/` and make sure `videos/configuration.php` exists.","status":"open","published_at":"2026-10-28T22:17:15+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","triaged_at":"2026-10-28T22:36:32+00:00","updated_at":"2026-10-28T22:36:32+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-28T22:36:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AVideo to `8.1.0` or later.\n- Until upgraded, block or remove access to `install/` and make sure `videos/configuration.php` exists.","reach":"internet","title":"AVideo: unauthenticated installer writes PHP config, enabling remote code execution","impact":"high","summary":"The unauthenticated installer endpoint install/checkConfiguration.php writes videos/configuration.php from request parameters without escaping, so an attacker can inject PHP that runs when the file loads. The same endpoint also has a SQL injection sink and can be pointed at an attacker-controlled database.","category":"package","nicknames":[],"who_cares":["avideo","php","self-hosted","video-platform"],"confidence":0.85,"needs_auth":"no","worst_case":"Attacker runs commands as the web-server user and reads or overwrites its files","analyst_note":"","how_to_check":"- Check the installed AVideo version; versions before `8.1.0` are affected.\n- Check whether `videos/configuration.php` is absent on the server, since the flaw requires it to be missing (for example on a fresh deployment).\n- Check whether `install/checkConfiguration.php` is reachable from the internet.","needs_analyst":false,"not_affected_if":["version-8.1.0-or-later","configuration-file-present"],"who_is_affected":"Any AVideo deployment running a version before 8.1.0 where videos/configuration.php is missing, as on every fresh install or after the file is removed or moved, and where the installer endpoint is reachable. Deployments already on 8.1.0 or later, or with a configuration file present, are not exposed through this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000661,"input_tokens":3605,"output_tokens":602,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-61564':13A,16A '8.1.0':78C,249C 'absent':131C 'addit':226C 'also':53B,188C 'arbitrari':200C 'assembl':84C 'attack':40B,66B,102C,169C 'attacker-control':65B 'avideo':1A,17B,69C 'base':195C 'base-directori':194C 'block':148C 'code':9A,216C 'command':201C 'config':6A 'configur':233C 'connect':159C,222C 'constraint':197C 'contain':155C 'control':67B,218C 'creat':236C 'credenti':183C 'cve':11A,14A 'databas':68B,177C,221C 'databasehost':161C 'databasepass':164C 'databaseus':162C 'deploy':136C 'deriv':189C 'direct':121C 'directori':196C 'enabl':7A 'endpoint':29B,52B,82C,150C,225C 'escap':37B,100C 'everi':134C 'execut':10A,111C,202C 'exist':146C 'exploit':126C 'file':48B,123C,140C,147C,206C 'fix':246C 'fresh':135C 'generat':120C 'host':22B 'includ':90C 'index.php':156C 'inject':42B,57B,108C,241C 'insert':234C 'instal':3A,28B,81C 'install/checkconfiguration.php':30B,83C 'interpol':87C,227C 'issu':244C 'liter':98C,106C 'load':49B,125C 'locat':186C 'move':144C 'must':154C,165C 'need':180C 'overwrit':205C 'own':207C 'packag':18B 'paramet':35B,89C,173C 'permit':199C 'persist':214C 'php':5A,19B,43B,96C,109C,215C 'platform':25B,75C 'point':62B,171C 'prior':76C 'quot':95C 'read':203C 'remot':8A 'remov':142C 'request':34B,88C,122C,228C 'requir':127C 'run':45B 'secondari':238C 'self':21B 'self-host':20B 'server':116C,178C,212C 'set':223C 'share':74C 'singl':94C 'single-quot':93C 'sink':58B,242C 'sql':56B,240C 'sql-inject':239C 'statement':235C 'store':220C 'streamer':231C 'string':97C 'succeed':166C 'suppli':152C 'systemrootpath':153C,191C 'target':182C 'termin':104C 'unauthent':2A,27B,80C 'use':160C 'user':117C,213C 'valu':229C 'version':248C 'video':24B,73C 'video-platform':23B 'video-shar':72C 'videos/configuration.php':32B,85C,128C 'web':115C,211C 'web-serv':114C,210C 'websiterooturl':91C 'without':36B,99C,192C 'write':4A,31B,185C","nicknames":[],"mitigations":[],"who_affected":"Any AVideo deployment running a version before 8.1.0 where videos/configuration.php is missing, as on every fresh install or after the file is removed or moved, and where the installer endpoint is reachable. Deployments already on 8.1.0 or later, or with a configuration file present, are not exposed through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61564","severity":null,"published_at":"2026-10-28T22:17:15+00:00","modified_at":"2026-10-28T22:17:15+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","fetched_at":"2026-10-28T22:35:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}