---
id: "CVE-2026-61575"
kind: "vulnerability"
aliases: ["CVE-2026-61575"]
title: "AVideo: queue filename title lets stored XSS run in admin browsers"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["avideo", "package", "php", "self-hosted"]
not_affected_if: ["no-encoder-queue-use", "version-8.1.0-or-later"]
published_at: "2026-10-28T22:17:16+00:00"
first_seen_at: "2026-10-28T22:35:35+00:00"
updated_at: "2026-10-28T22:37:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61575", "first_seen_at": "2026-10-28T22:35:35+00:00"}]
---

# AVideo: queue filename title lets stored XSS run in admin browsers

AVideo before 8.1.0 stores a crafted filename from the encoder queue as a title and renders it unescaped in the admin encoder grid. An attacker who can self-grant upload rights can run JavaScript in an administrator's or operator's browser, acting with that user's privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the AVideo version in the deployed code, for example `grep -i version` in the project's version file, and confirm it is below `8.1.0`.
- Look at `view/queue.php` for a `pathinfo` call on `fileURI` that feeds `setTitle` without escaping.
- Check whether non-administrator accounts can self-grant upload capability through a login site.

## Fix

- Upgrade AVideo to `8.1.0` or later.
- Until upgraded, restrict encoder queue access to trusted accounts and review existing `encoder_queue` rows for HTML in titles.

## Timeline

- 2026-10-28T22:35:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61575

## From the sources

AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filename through `setTitle` in `encoder_queue.title` without neutralization. `fileURI` is not in the `objects/security.php` filter lists, and the `Login::canUpload()` capability needed to submit a queue entry can be self-granted using an attacker-controlled login site without legitimate encoder credentials. `view/index.php` loads `queue.json` from `view/queue.json.php` into the `#grid` jQuery Bootgrid table; its title formatter concatenates `row.title` into raw cell HTML. An attacker can therefore store an HTML title whose event handler runs in a privileged viewer's browser. `Encoder::getAll` limits nonadministrators to their own streamer's rows, so the victim must be an administrator who sees all rows or an operator on the attacker's streamer. A second `.html()` sink in the progress panel uses the same title but additionally depends on a helper script loaded from the streamer; the Bootgrid sink is reachable from encoder code alone. The script can read session-visible data and rendered streamer credentials, act with the viewer's privileges, and execute again for each qualifying viewer until the row is removed. This issue is fixed in version 8.1.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_