{"schema":"threatline.record/2","record":{"id":"CVE-2026-61567","aliases":["GHSA-rf63-6vwm-wv8p"],"summary":"AVideo-Encoder: unauthenticated command execution through streamer login trust","details":"AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant `isLogged` and `canStream` without legitimate credentials. The endpoint requires only nonempty `playlists_id` and `APISecret` values; `APISecret` is forwarded rather than checked against a stored secret. This path never calls `Streamer::isURLAllowed` and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates `videos[].path` without shell argument escaping into `ffprobe` and `ffmpeg` commands passed to `exec`; `isAudio` calls `isVideo` to reach the `ffprobe` command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.","categories":["Unclassified"],"product":"AVideo-Encoder","vendor":"WWBN","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61567","source_modified_at":"2026-10-28T21:43:48.515Z","fetched_at":"2026-10-29T00:48:09.584895Z","product":"AVideo-Encoder","vendor":"WWBN","versions":[{"version":"< 8.1.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":10,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T21:43:48.515Z","modified_at":"2026-10-28T21:43:48.515Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-61567","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-28T21:43:48.515Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-rf63-6vwm-wv8p","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/WWBN/AVideo-Encoder/commit/99b8ad9b66fe5726cababbe29dce9d9695131caa","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T21:43:48.515Z","content_hash":"b157645aa220f29edbf8997d398842915316a37820da39a01fa9df3711e2d88c"}}