{"id":"CVE-2026-61575","kind":"vulnerability","aliases":["CVE-2026-61575"],"related":[],"title":"AVideo: queue filename title lets stored XSS run in admin browsers","description":"AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filename through `setTitle` in `encoder_queue.title` without neutralization. `fileURI` is not in the `objects/security.php` filter lists, and the `Login::canUpload()` capability needed to submit a queue entry can be self-granted using an attacker-controlled login site without legitimate encoder credentials. `view/index.php` loads `queue.json` from `view/queue.json.php` into the `#grid` jQuery Bootgrid table; its title formatter concatenates `row.title` into raw cell HTML. An attacker can therefore store an HTML title whose event handler runs in a privileged viewer's browser. `Encoder::getAll` limits nonadministrators to their own streamer's rows, so the victim must be an administrator who sees all rows or an operator on the attacker's streamer. A second `.html()` sink in the progress panel uses the same title but additionally depends on a helper script loaded from the streamer; the Bootgrid sink is reachable from encoder code alone. The script can read session-visible data and rendered streamer credentials, act with the viewer's privileges, and execute again for each qualifying viewer until the row is removed. This issue is fixed in version 8.1.0.","summary":"AVideo before 8.1.0 stores a crafted filename from the encoder queue as a title and renders it unescaped in the admin encoder grid. An attacker who can self-grant upload rights can run JavaScript in an administrator's or operator's browser, acting with that user's privileges.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avideo","package","php","self-hosted"],"not_affected_if":["no-encoder-queue-use","version-8.1.0-or-later"],"how_to_check":"- Check the AVideo version in the deployed code, for example `grep -i version` in the project's version file, and confirm it is below `8.1.0`.\n- Look at `view/queue.php` for a `pathinfo` call on `fileURI` that feeds `setTitle` without escaping.\n- Check whether non-administrator accounts can self-grant upload capability through a login site.","fix":"- Upgrade AVideo to `8.1.0` or later.\n- Until upgraded, restrict encoder queue access to trusted accounts and review existing `encoder_queue` rows for HTML in titles.","status":"open","published_at":"2026-10-28T22:17:16+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","triaged_at":"2026-10-28T22:37:03+00:00","updated_at":"2026-10-28T22:37:03+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T22:37:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AVideo to `8.1.0` or later.\n- Until upgraded, restrict encoder queue access to trusted accounts and review existing `encoder_queue` rows for HTML in titles.","reach":"internet","title":"AVideo: queue filename title lets stored XSS run in admin browsers","impact":"medium","summary":"AVideo before 8.1.0 stores a crafted filename from the encoder queue as a title and renders it unescaped in the admin encoder grid. An attacker who can self-grant upload rights can run JavaScript in an administrator's or operator's browser, acting with that user's privileges.","category":"package","nicknames":[],"who_cares":["avideo","self-hosted","php"],"confidence":0.8,"needs_auth":"yes","worst_case":"Script runs in admin browser, acting with viewer privileges and reading session data.","analyst_note":"","how_to_check":"- Check the AVideo version in the deployed code, for example `grep -i version` in the project's version file, and confirm it is below `8.1.0`.\n- Look at `view/queue.php` for a `pathinfo` call on `fileURI` that feeds `setTitle` without escaping.\n- Check whether non-administrator accounts can self-grant upload capability through a login site.","needs_analyst":false,"not_affected_if":["version-8.1.0-or-later","no-encoder-queue-use"],"who_is_affected":"Self-hosted AVideo instances running a version before 8.1.0 with the encoder queue in use. The exposure depends on attackers being able to self-grant upload capability through an attacker-controlled login site, and on an administrator or an operator of the attacker's streamer viewing the queue grid. Instances already on 8.1.0 or later are not affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":3644,"output_tokens":639,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-61575':14A,17A '8.1.0':26B,82C,272C 'act':67B,248C 'addit':217C 'admin':10A,44B 'administr':61B,191C 'alon':235C 'attack':48B,129C,158C,201C 'attacker-control':128C 'avideo':1A,18B,24B,73C 'bootgrid':146C,228C 'browser':11A,66B,174C 'caller':89C 'caller-control':88C 'canupload':113C 'capabl':114C 'cell':155C 'code':234C 'concaten':151C 'control':90C,130C 'craft':29B 'credenti':136C,247C 'cve':12A,15A 'data':243C 'depend':218C 'encod':33B,45B,135C,175C,233C 'encoder_queue.title':99C 'entri':120C 'event':166C 'execut':255C 'filenam':3A,30B,95C 'fileuri':91C,102C 'filter':108C 'fix':269C 'formatt':150C 'getal':176C 'grant':53B,125C 'grid':46B,144C 'handler':167C 'helper':221C 'host':23B 'html':156C,163C,206C 'issu':267C 'javascript':58B 'jqueri':145C 'legitim':134C 'let':5A 'limit':177C 'list':109C 'load':138C,223C 'login':112C,131C 'must':188C 'need':115C 'neutral':101C 'nonadministr':178C 'objects/security.php':107C 'oper':64B,198C 'packag':19B 'panel':211C 'pathinfo':85C 'php':20B 'platform':79C 'prior':80C 'privileg':72B,171C,253C 'progress':210C 'qualifi':259C 'queue':2A,34B,119C 'queue.json':139C 'raw':154C 'reachabl':231C 'read':239C 'remov':265C 'render':39B,245C 'right':55B 'row':184C,195C,263C 'row.title':152C 'run':8A,57B,168C 'script':222C,237C 'second':205C 'see':193C 'self':22B,52B,124C 'self-grant':51B,123C 'self-host':21B 'session':241C 'session-vis':240C 'settitl':97C 'share':78C 'sink':207C,229C 'site':132C 'store':6A,27B,93C,161C 'streamer':182C,203C,226C,246C 'submit':117C 'tabl':147C 'therefor':160C 'titl':4A,37B,149C,164C,215C 'unescap':41B 'upload':54B 'use':84C,126C,212C 'user':70B 'version':271C 'victim':187C 'video':77C 'video-shar':76C 'view/index.php':137C 'view/queue.json.php':141C 'view/queue.php':83C 'viewer':172C,251C,260C 'visibl':242C 'whose':165C 'without':100C,133C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted AVideo instances running a version before 8.1.0 with the encoder queue in use. The exposure depends on attackers being able to self-grant upload capability through an attacker-controlled login site, and on an administrator or an operator of the attacker's streamer viewing the queue grid. Instances already on 8.1.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61575","severity":null,"published_at":"2026-10-28T22:17:16+00:00","modified_at":"2026-10-28T22:17:16+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","fetched_at":"2026-10-28T22:35:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}