{"id":"CVE-2026-61567","kind":"vulnerability","aliases":["CVE-2026-61567"],"related":[],"title":"AVideo: unauthenticated live-stream endpoint lets attackers run OS commands","description":"AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant `isLogged` and `canStream` without legitimate credentials. The endpoint requires only nonempty `playlists_id` and `APISecret` values; `APISecret` is forwarded rather than checked against a stored secret. This path never calls `Streamer::isURLAllowed` and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates `videos[].path` without shell argument escaping into `ffprobe` and `ffmpeg` commands passed to `exec`; `isAudio` calls `isVideo` to reach the `ffprobe` command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.","summary":"AVideo's live-streaming endpoint view/videosListToLive.php trusts attacker-hosted JSON as login state, so an unauthenticated remote caller can self-grant streaming rights. Attacker-supplied video paths are then passed unescaped to ffprobe and ffmpeg through exec, letting the attacker run shell commands as the web-server user and read database and streamer credentials.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avideo","package","php","self-hosted","video-streaming"],"not_affected_if":["endpoint-not-exposed","patched-8.1.0-or-later"],"how_to_check":"- Check the AVideo version in the installed codebase; affected versions are those before `8.1.0`\n- Confirm whether `view/videosListToLive.php` is reachable from the internet on the deployed instance","fix":"- Upgrade AVideo to `8.1.0` or later\n- Until upgraded, block external access to `view/videosListToLive.php` at the web server or firewall\n- Rotate database credentials and stored streamer credentials if the instance was exposed","status":"open","published_at":"2026-10-28T22:17:15+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","triaged_at":"2026-10-28T22:36:32+00:00","updated_at":"2026-10-28T22:36:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T22:36:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AVideo to `8.1.0` or later\n- Until upgraded, block external access to `view/videosListToLive.php` at the web server or firewall\n- Rotate database credentials and stored streamer credentials if the instance was exposed","reach":"internet","title":"AVideo: unauthenticated live-stream endpoint lets attackers run OS commands","impact":"high","summary":"AVideo's live-streaming endpoint view/videosListToLive.php trusts attacker-hosted JSON as login state, so an unauthenticated remote caller can self-grant streaming rights. Attacker-supplied video paths are then passed unescaped to ffprobe and ffmpeg through exec, letting the attacker run shell commands as the web-server user and read database and streamer credentials.","category":"package","nicknames":[],"who_cares":["avideo","php","self-hosted","video-streaming"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs OS commands as web-server user and reads database credentials","analyst_note":"Confirm from the advisory or the 8.1.0 release notes whether any non-default configuration is required and whether the endpoint is enabled by default.","how_to_check":"- Check the AVideo version in the installed codebase; affected versions are those before `8.1.0`\n- Confirm whether `view/videosListToLive.php` is reachable from the internet on the deployed instance","needs_analyst":true,"not_affected_if":["patched-8.1.0-or-later","endpoint-not-exposed"],"who_is_affected":"Any AVideo deployment before 8.1.0 whose web server can reach the live-streaming endpoint from the internet or an untrusted network. The sources say the streamer allowlist does not protect this path, so allowlist settings are not a mitigation. Instances that are not running AVideo, or that run 8.1.0 or later, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000708,"input_tokens":3657,"output_tokens":684,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-61567':14A,17A '8.1.0':95C,281C 'accept':102C 'allowlist':182C 'apisecret':155C,157C 'arbitrari':223C 'argument':200C 'attack':8A,36B,54B,70B,105C,126C,188C 'attacker-control':187C 'attacker-host':35B 'attacker-nam':104C 'attacker-suppli':53B 'avideo':1A,18B,27B,86C 'call':110C,170C,211C 'caller':46B 'canstream':143C 'check':162C 'command':11A,73B,206C,217C,227C 'compromis':253C 'contain':219C 'control':189C 'credenti':85B,146C,252C,259C 'cve':12A,15A 'databas':82B,248C 'delimit':221C 'deni':272C 'disclos':247C 'encod':136C,273C 'endpoint':6A,32B,100C,148C 'escap':201C 'establish':269C 'exec':67B,209C 'execut':222C 'fetch':184C 'ffmpeg':65B,205C 'ffprobe':63B,203C,216C 'file':261C 'filter':236C 'fix':278C 'forward':159C 'grant':50B,140C 'host':23B,37B,129C 'http':131C 'id':153C 'inspect':239C 'interpol':195C 'isaudio':210C 'islog':141C 'issu':276C 'isurlallow':172C 'isvideo':212C 'json':38B,119C,244C 'legitim':145C 'let':7A,68B 'list':192C,243C 'live':4A,30B,98C 'live-stream':3A,29B,97C 'login':40B,111C 'modifi':260C 'name':106C 'never':169C 'nonempti':151C 'objects/login.php':114C 'oper':179C,225C 'operating-system':224C 'os':10A 'own':262C 'packag':19B 'pass':60B,207C 'path':57B,168C,197C,218C 'persist':270C 'php':20B 'platform':92C,256C 'playlist':152C 'prior':93C 'rather':160C 'reach':214C 'reachabl':133C 'read':81B 'regardless':176C 'remot':45B,125C 'request':235C 'requir':149C 'respons':193C 'return':118C 'right':52B 'run':9A,71B,112C 'second':186C 'secret':166C 'self':22B,49B,139C 'self-grant':48B,138C 'self-host':21B 'server':78B,232C,267C 'servic':132C,274C 'session':121C 'share':91C 'shell':72B,199C,220C 'state':41B,122C 'store':165C,250C 'stream':5A,26B,31B,51B,99C 'streamer':84B,107C,171C,181C,251C 'suppli':55B 'system':226C 'therefor':174C 'trust':34B,116C 'unauthent':2A,44B,124C 'unescap':61B 'upstream':255C 'use':257C 'user':79B,233C,268C 'valu':156C 'version':280C 'video':25B,56B,90C,191C,196C,242C 'video-list':190C,241C 'video-shar':89C 'video-stream':24B 'view/videoslisttolive.php':33B,101C 'web':77B,231C,266C 'web-serv':76B,230C,265C 'websiterooturl':109C 'without':144C,198C 'work':175C","nicknames":[],"mitigations":[],"who_affected":"Any AVideo deployment before 8.1.0 whose web server can reach the live-streaming endpoint from the internet or an untrusted network. The sources say the streamer allowlist does not protect this path, so allowlist settings are not a mitigation. Instances that are not running AVideo, or that run 8.1.0 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61567","severity":null,"published_at":"2026-10-28T22:17:15+00:00","modified_at":"2026-10-28T22:17:15+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","fetched_at":"2026-10-28T22:35:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}