CVE-2026-61564 in AVideo-Encoder
Summary
by MITRE • 10/28/2026
AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php and a connection using `databaseHost`, `databaseUser`, and `databasePass` must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from `systemRootPath` without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
AVideo is an open-source video-sharing platform that relies on PHP for its backend logic. A critical security vulnerability exists within the unauthenticated installer endpoint located at install/checkConfiguration.php, specifically affecting versions prior to 8.1.0. This flaw allows remote attackers with no authentication credentials to achieve arbitrary code execution and database manipulation through a combination of insecure file handling and improper input validation. The core technical issue stems from how the application constructs configuration files during its initial setup or reconfiguration phase. When an attacker interacts with this endpoint, the server assembles the videos/configuration.php file by interpolating user-supplied request parameters directly into single-quoted PHP string literals without performing any escaping or sanitization operations. This lack of input validation creates a classic code injection vector where malicious payloads can terminate the intended string context and inject arbitrary PHP commands that are subsequently executed with the privileges of the web-server process.
The exploitation of this vulnerability is contingent upon specific environmental conditions, primarily the absence of an existing videos/configuration.php file. In typical production environments where AVideo has been previously installed and configured, this file would already exist, thereby blocking access to or execution of this vulnerable endpoint logic. However, on fresh deployments, after a manual removal of configuration files, or in scenarios where the attacker can force the deletion of these artifacts, the vulnerability becomes fully exploitable. The attack does not require knowledge of valid database credentials for the target system because the attacker controls the connection parameters such as databaseHost, databaseUser, and databasePass. By pointing these values to a maliciously controlled database server, an attacker can ensure that any validation checks performed by the application succeed on their own infrastructure, effectively bypassing credential-based defenses entirely.
The impact of this vulnerability is severe due to the lack of base-directory constraints in the systemRootPath parameter used for determining write locations. This allows attackers to dictate where configuration files are written or modified, potentially leading to arbitrary file writes across the filesystem if directory traversal sequences can be utilized effectively within the path parameters. The immediate operational consequence is remote code execution as the web-server user, which grants the attacker significant control over the underlying system. Beyond simple command execution, this flaw enables persistent backdoor installation through PHP code injection and allows for the reading or overwriting of sensitive files owned by the web server process. Furthermore, because the endpoint interpolates request values into SQL INSERT statements alongside the file generation logic, it introduces a secondary vulnerability class: SQL Injection. This dual nature means that an attacker can not only execute system commands but also manipulate database records directly, compromising data integrity and confidentiality simultaneously.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) due to the unescaped interpolation into PHP strings, as well as CWE-89 SQL Injection for the secondary sink within the INSERT statements. The exploitation technique maps closely to MITRE ATT&CK techniques involving Server-Side Request Forgery or Remote Code Execution via web application vulnerabilities, specifically leveraging improper input validation and insecure direct object references in configuration management processes. To mitigate this risk, organizations running AVideo must immediately upgrade to version 8.1.0 or later where these issues have been addressed through proper escaping mechanisms and stricter path constraints. For systems that cannot be upgraded instantly, implementing a Web Application Firewall rule to block requests containing suspicious characters within the install/checkConfiguration.php endpoint parameters can provide temporary protection until patching is completed. Additionally ensuring that configuration files are present and immutable in production environments reduces the attack surface by preventing the application from entering the vulnerable code path entirely.