Remote Code Execution Vulnerability in AVideo Streaming Platform
CVE-2026-61567
What is CVE-2026-61567?
The AVideo Encoder platform prior to version 8.1.0 is vulnerable to a remote code execution flaw that allows unauthenticated attackers to execute arbitrary commands on the server. The vulnerability arises when the live-streaming endpoint does not properly validate the input for the webSiteRootURL parameter and trusts the resultant session state. This means an attacker can exploit this by supplying crafted input, resulting in unauthorized privileges such as isLogged and canStream. Furthermore, by manipulating the video-list response, attackers can execute system commands, potentially compromising the web server and underlying systems. A comprehensive security update has been made in version 8.1.0 to mitigate this serious threat. User action is recommended to upgrade promptly.
Affected Version(s)
AVideo-Encoder < 8.1.0