{"id":"CVE-2026-61571","kind":"vulnerability","aliases":["CVE-2026-61571"],"related":[],"title":"AVideo: unauthenticated encoder endpoints expose queue data and trigger processing","description":"AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `view/run.php` has a commented-out guard and invokes `Encoder::run()`. `view/queue.json.php` calls `Encoder::getAll(true)`, reveals streamer URLs through `getSiteURL()`, and triggers processing with `execRun()`. `view/status.php` returns `Access-Control-Allow-Origin` with a wildcard, reads the queue, triggers processing, and exposes host memory statistics through `ServerMonitor::getMemory()` when `serverStatus` is set. `view/listFiles.json.php` checks only `Login::canBulkEncode()`, which admits anonymous callers whenever `disableBulkEncode` is empty, the default. Its `path` parameter is resolved with `realpath()` and listed with `scandir()` without a base-directory restriction. An unauthenticated attacker can drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics and enumerate media file names and paths in any directory readable by the web-server user. Enumeration is limited to configured media extensions and does not itself disclose arbitrary file contents. This issue is fixed in version 8.1.0.","summary":"AVideo's encoder exposes several PHP endpoints (run, queue, status, listFiles) with no authentication by default, so anyone on the network can start encoding jobs. An attacker can also read queue and streamer-site details, host memory statistics, and enumerate media file names and paths in directories the web-server user can read.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avideo","package","php","self-hosted","video-platform"],"not_affected_if":["bulk-encode-disabled","network-restricted","version-8.1.0-or-later"],"how_to_check":"- Check the AVideo version; affected releases are those before `8.1.0`.\n- Request `view/queue.json.php` or `view/status.php` without logging in and see whether they return data.\n- Check whether `disableBulkEncode` is set in the AVideo configuration; if it is empty (the default), `view/listFiles.json.php` admits anonymous callers.","fix":"- Upgrade AVideo to `8.1.0` or later.\n- Until upgraded, set `disableBulkEncode` to a non-empty value and restrict access to the `view/run.php`, `view/queue.json.php`, `view/status.php` and `view/listFiles.json.php` endpoints at the web server or firewall.","status":"open","published_at":"2026-10-28T22:17:16+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","triaged_at":"2026-10-28T22:36:50+00:00","updated_at":"2026-10-28T22:36:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T22:36:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AVideo to `8.1.0` or later.\n- Until upgraded, set `disableBulkEncode` to a non-empty value and restrict access to the `view/run.php`, `view/queue.json.php`, `view/status.php` and `view/listFiles.json.php` endpoints at the web server or firewall.","reach":"internet","title":"AVideo: unauthenticated encoder endpoints expose queue data and trigger processing","impact":"medium","summary":"AVideo's encoder exposes several PHP endpoints (run, queue, status, listFiles) with no authentication by default, so anyone on the network can start encoding jobs. An attacker can also read queue and streamer-site details, host memory statistics, and enumerate media file names and paths in directories the web-server user can read.","category":"package","nicknames":[],"who_cares":["avideo","php","self-hosted","video-platform"],"confidence":0.8,"needs_auth":"no","worst_case":"anonymous users drive encoder jobs and enumerate media file paths","analyst_note":"","how_to_check":"- Check the AVideo version; affected releases are those before `8.1.0`.\n- Request `view/queue.json.php` or `view/status.php` without logging in and see whether they return data.\n- Check whether `disableBulkEncode` is set in the AVideo configuration; if it is empty (the default), `view/listFiles.json.php` admits anonymous callers.","needs_analyst":false,"not_affected_if":["version-8.1.0-or-later","network-restricted","bulk-encode-disabled"],"who_is_affected":"AVideo installations before 8.1.0 that are reachable from a network an attacker can reach, especially with the default configuration where bulk encode is not disabled. Instances behind a login-only proxy or not exposed to untrusted networks are less exposed. Sites on newer versions can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":3635,"output_tokens":674,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-61571':13A,16A '8.1.0':90C,251C 'access':138C 'access-control-allow-origin':137C 'admit':168C 'allow':140C 'also':54B 'anonym':106C,169C 'anyon':43B 'arbitrari':242C 'attack':52B,196C 'authent':39B,96C 'avideo':1A,17B,26B,81C 'base':191C 'base-directori':190C 'call':121C 'caller':108C,170C 'canbulkencod':166C 'check':163C 'comment':113C 'commented-out':112C 'configur':234C 'content':244C 'control':100C,139C 'cve':11A,14A 'data':7A 'default':41B,176C 'detail':61B 'directori':73B,192C,222C 'disablebulkencod':172C 'disclos':241C 'drive':198C 'empti':174C 'encod':3A,28B,49B,92C,118C,122C 'endpoint':4A,32B,104C 'enumer':66B,214C,230C 'execrun':134C 'expos':5A,29B,99C,151C 'extens':236C 'file':68B,216C,243C 'fix':248C 'getal':123C 'getmemori':157C 'getsiteurl':129C 'global':95C 'guard':115C 'host':22B,62B,152C 'inform':209C 'invok':117C 'issu':246C 'job':50B 'lack':93C 'layer':97C 'limit':232C 'list':185C 'listfil':36B 'login':165C 'media':67B,215C,235C 'memori':63B,153C,211C 'name':69B,217C 'network':46B,107C 'obtain':210C 'origin':141C 'packag':18B 'paramet':179C 'path':71B,178C,219C 'php':19B,31B,103C 'platform':25B,87C 'prior':88C 'privileg':200C 'process':10A,132C,149C 'processor':202C 'queue':6A,34B,56B,147C,201C,204C 'read':55B,80B,145C,203C 'readabl':223C 'realpath':183C 'resolv':181C 'restrict':193C 'return':136C 'reveal':125C 'run':33B,119C 'scandir':187C 'self':21B 'self-host':20B 'server':77B,228C 'servermonitor':156C 'serverstatus':159C 'set':161C 'sever':30B 'share':86C 'site':60B,208C 'start':48B 'statist':64B,154C,212C 'status':35B,102C 'streamer':59B,126C,207C 'streamer-sit':58B,206C 'trigger':9A,131C,148C 'true':124C 'unauthent':2A,195C 'url':127C 'user':78B,229C 'version':250C 'video':24B,85C 'video-platform':23B 'video-shar':84C 'view/listfiles.json.php':162C 'view/queue.json.php':120C 'view/run.php':109C 'view/status.php':135C 'web':76B,227C 'web-serv':75B,226C 'whenev':171C 'wildcard':144C 'without':188C","nicknames":[],"mitigations":[],"who_affected":"AVideo installations before 8.1.0 that are reachable from a network an attacker can reach, especially with the default configuration where bulk encode is not disabled. Instances behind a login-only proxy or not exposed to untrusted networks are less exposed. Sites on newer versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61571","severity":null,"published_at":"2026-10-28T22:17:16+00:00","modified_at":"2026-10-28T22:17:16+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","fetched_at":"2026-10-28T22:35:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}