Unsecured Installer Endpoint in AVideo Video-Sharing Platform

CVE-2026-61564

What is CVE-2026-61564?

The AVideo video-sharing platform is vulnerable due to an unauthenticated installer endpoint, install/checkConfiguration.php, which improperly handles request parameters during the assembly of videos/configuration.php. This vulnerability allows attackers to inject arbitrary PHP code that executes as the web-server user, provided that the videos/configuration.php file is missing. Exploitation of this vulnerability can lead to arbitrary command execution, file reading and writing, and persistent PHP code injection. In addition, the endpoint is susceptible to SQL injection due to the interpolation of request values into database interaction statements. This critical issue was addressed in version 8.1.0 of AVideo.

References