Code Injection Vulnerability in AVideo Video-Sharing Platform

CVE-2026-61575

What is CVE-2026-61575?

AVideo, a popular video-sharing platform, is vulnerable to a code injection attack due to improper handling of user-controlled input in the 'view/queue.php' file. Prior to version 8.1.0, attackers could manipulate the 'fileURI' parameter to store malicious HTML content in the encoder queue title without appropriate sanitization. This allows adversaries to execute scripts in the context of an unsuspecting user's browser, particularly affecting administrators who have access to all encoder rows. The vulnerability has been patched in version 8.1.0, ensuring that user inputs are properly filtered to prevent such exploits.

References