{"affected":[{"product":"AVideo-Encoder","source":"CNA: GitHub_M","vendor":"WWBN","versions":[{"status":"affected","version":"< 8.1.0"}]}],"cveId":"CVE-2026-61564","cwes":["CWE-94"],"description":"AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php and a connection using `databaseHost`, `databaseUser`, and `databasePass` must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from `systemRootPath` without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.","epss":{"date":"2026-11-02","percentile":0.45359,"score":0.00539},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-xrj3-cqm8-r992"}],"kev":null,"metrics":[{"score":10,"severity":"critical","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793713543834,"publishedAt":1793223762397,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-xrj3-cqm8-r992"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/WWBN/AVideo-Encoder/commit/0faaddebd11c087885d25a7e0513745465cad411"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-xrj3-cqm8-r992"}],"remediation":[],"revision":"a2f3baf7bc8d51876f490736f3d87860626a21079ffbbc13279c74b4d909ddad","sources":[{"modifiedAt":1793713543834,"name":"CNA: GitHub_M","retrievedAt":1793714987187,"url":"https://www.cve.org/CVERecord?id=CVE-2026-61564"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793715000435,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61564"}],"ssvc":{"assessedAt":1793713505302,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"AVideo-Encoder: unauthenticated installer PHP code injection","updatedAt":1793715000435}