Live › vulnerability › CVE-2026-61567
Go to dashboardAVideo's live-streaming endpoint view/videosListToLive.php trusts attacker-hosted JSON as login state, so an unauthenticated remote caller can self-grant streaming rights. Attacker-supplied video paths are then passed unescaped to ffprobe and ffmpeg through exec, letting the attacker run shell commands as the web-server user and read database and streamer credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Any AVideo deployment before 8.1.0 whose web server can reach the live-streaming endpoint from the internet or an untrusted network. The sources say the streamer allowlist does not protect this path, so allowlist settings are not a mitigation. Instances that are not running AVideo, or that run 8.1.0 or later, are not affected.
No product ranges from the sources yet.
8.1.0view/videosListToLive.php is reachable from the internet on the deployed instance8.1.0 or laterview/videosListToLive.php at the web server or firewallEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant isLogged and canStream without legitimate credentials. The endpoint requires only nonempty playlists_id and APISecret values; APISecret is forwarded rather than checked against a stored secret. This path never calls Streamer::isURLAllowed and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates videos[].path without shell argument escaping into ffprobe and ffmpeg commands passed to exec; isAudio calls isVideo to reach the ffprobe command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-61567")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.