---
id: "CVE-2026-61571"
kind: "vulnerability"
aliases: ["CVE-2026-61571"]
title: "AVideo: unauthenticated encoder endpoints expose queue data and trigger processing"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["avideo", "package", "php", "self-hosted", "video-platform"]
not_affected_if: ["bulk-encode-disabled", "network-restricted", "version-8.1.0-or-later"]
published_at: "2026-10-28T22:17:16+00:00"
first_seen_at: "2026-10-28T22:35:35+00:00"
updated_at: "2026-10-28T22:36:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61571", "first_seen_at": "2026-10-28T22:35:35+00:00"}]
---

# AVideo: unauthenticated encoder endpoints expose queue data and trigger processing

AVideo's encoder exposes several PHP endpoints (run, queue, status, listFiles) with no authentication by default, so anyone on the network can start encoding jobs. An attacker can also read queue and streamer-site details, host memory statistics, and enumerate media file names and paths in directories the web-server user can read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the AVideo version; affected releases are those before `8.1.0`.
- Request `view/queue.json.php` or `view/status.php` without logging in and see whether they return data.
- Check whether `disableBulkEncode` is set in the AVideo configuration; if it is empty (the default), `view/listFiles.json.php` admits anonymous callers.

## Fix

- Upgrade AVideo to `8.1.0` or later.
- Until upgraded, set `disableBulkEncode` to a non-empty value and restrict access to the `view/run.php`, `view/queue.json.php`, `view/status.php` and `view/listFiles.json.php` endpoints at the web server or firewall.

## Timeline

- 2026-10-28T22:35:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61571

## From the sources

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `view/run.php` has a commented-out guard and invokes `Encoder::run()`. `view/queue.json.php` calls `Encoder::getAll(true)`, reveals streamer URLs through `getSiteURL()`, and triggers processing with `execRun()`. `view/status.php` returns `Access-Control-Allow-Origin` with a wildcard, reads the queue, triggers processing, and exposes host memory statistics through `ServerMonitor::getMemory()` when `serverStatus` is set. `view/listFiles.json.php` checks only `Login::canBulkEncode()`, which admits anonymous callers whenever `disableBulkEncode` is empty, the default. Its `path` parameter is resolved with `realpath()` and listed with `scandir()` without a base-directory restriction. An unauthenticated attacker can drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics and enumerate media file names and paths in any directory readable by the web-server user. Enumeration is limited to configured media extensions and does not itself disclose arbitrary file contents. This issue is fixed in version 8.1.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_