Remote Code Execution in AVideo Video-Sharing Platform

CVE-2026-61572

What is CVE-2026-61572?

AVideo, a popular video-sharing platform, has a vulnerability due to its mishandling of user input in the url_get_contents function. The initial attempts at remediation in version 8.1.0 addressed certain issues, but the platform still permits the acceptance of caller-controlled URLs, including private and local addresses. Furthermore, it disables TLS peer verification, exposing it to risks of an attacker exploiting weak session validations through manipulated cookies. This allows unauthorized remote access to sensitive information and internal services, including cloud instance-metadata credentials and FTP services, without requiring any user interaction or authentication. While version 8.1.0 made some security improvements, it still leaves critical aspects of the vulnerability unaddressed.

References