CVE-2026-61567

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant isLogged and canStream without legitimate credentials. The endpoint requires only nonempty playlists_id and APISecret values; APISecret is forwarded rather than checked against a stored secret. This path never calls Streamer::isURLAllowed and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates videos[].path without shell argument escaping into ffprobe and ffmpeg commands passed to exec; isAudio calls isVideo to reach the ffprobe command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant isLogged and canStream without legitimate credentials. The endpoint requires only nonempty playlists_id and APISecret values; APISecret is forwarded rather than checked against a stored secret. This path never calls Streamer::isURLAllowed and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates videos[].path without shell argument escaping into ffprobe and ffmpeg commands passed to exec; isAudio calls isVideo to reach the ffprobe command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant isLogged and canStream without legitimate credentials. The endpoint requires only nonempty playlists_id and APISecret values; APISecret is forwarded rather than checked against a stored secret. This path never calls Streamer::isURLAllowed and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates videos[].path without shell argument escaping into ffprobe and ffmpeg commands passed to exec; isAudio calls isVideo to reach the ffprobe command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant isLogged and canStream without legitimate credentials. The endpoint requires only nonempty playlists_id and APISecret values; APISecret is forwarded rather than checked against a stored secret. This path never calls Streamer::isURLAllowed and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates videos[].path without shell argument escaping into ffprobe and ffmpeg commands passed to exec; isAudio calls isVideo to reach the ffprobe command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.