---
id: "CVE-2026-61564"
kind: "vulnerability"
aliases: ["CVE-2026-61564"]
title: "AVideo: unauthenticated installer writes PHP config, enabling remote code execution"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["avideo", "package", "php", "self-hosted", "video-platform"]
not_affected_if: ["configuration-file-present", "version-8.1.0-or-later"]
published_at: "2026-10-28T22:17:15+00:00"
first_seen_at: "2026-10-28T22:35:35+00:00"
updated_at: "2026-10-28T22:36:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61564", "first_seen_at": "2026-10-28T22:35:35+00:00"}]
---

# AVideo: unauthenticated installer writes PHP config, enabling remote code execution

The unauthenticated installer endpoint install/checkConfiguration.php writes videos/configuration.php from request parameters without escaping, so an attacker can inject PHP that runs when the file loads. The same endpoint also has a SQL injection sink and can be pointed at an attacker-controlled database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AVideo version; versions before `8.1.0` are affected.
- Check whether `videos/configuration.php` is absent on the server, since the flaw requires it to be missing (for example on a fresh deployment).
- Check whether `install/checkConfiguration.php` is reachable from the internet.

## Fix

- Upgrade AVideo to `8.1.0` or later.
- Until upgraded, block or remove access to `install/` and make sure `videos/configuration.php` exists.

## Timeline

- 2026-10-28T22:35:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61564

## From the sources

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php and a connection using `databaseHost`, `databaseUser`, and `databasePass` must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from `systemRootPath` without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_