{"schema":"threatline.record/2","record":{"id":"CVE-2026-61564","aliases":["GHSA-xrj3-cqm8-r992"],"summary":"AVideo-Encoder: unauthenticated installer PHP code injection","details":"AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php and a connection using `databaseHost`, `databaseUser`, and `databasePass` must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from `systemRootPath` without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.","categories":["Unclassified"],"product":"AVideo-Encoder","vendor":"WWBN","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61564","source_modified_at":"2026-10-28T21:42:42.397Z","fetched_at":"2026-10-29T00:48:09.584895Z","product":"AVideo-Encoder","vendor":"WWBN","versions":[{"version":"< 8.1.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":10,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T21:42:42.397Z","modified_at":"2026-10-28T21:42:42.397Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-61564","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-28T21:42:42.397Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-xrj3-cqm8-r992","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/WWBN/AVideo-Encoder/commit/0faaddebd11c087885d25a7e0513745465cad411","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T21:42:42.397Z","content_hash":"c997e8362d1ee79c09065e7a16a9c0b2fb9643b8f67aa5576ba4be89d452acff"}}