CVE-2026-61564: AVideo Unauthenticated RCE
Critical CVSS (10.0) reachable over network.
CVE-2026-61564 is a critical AVideo remote code execution vulnerability affecting versions before 8.1.0. Under specific deployment conditions, an unauthenticated attacker can inject PHP code into a generated configuration file and execute it with web-server privileges.
TL;DR - CVE-2026-61564 is a critical unauthenticated PHP-code-injection flaw in AVideo before 8.1.0. - Fresh, incomplete, or reconfigured deployments are most exposed when
videos/configuration.phpis absent. - No public PoC or confirmed in-the-wild exploitation was identified, but upgrade to 8.1.0 or later immediately.
Summary
CVE-2026-61564 affects the WWBN AVideo video-sharing platform and is associated with the AVideo-Encoder repository. The vulnerable installer endpoint, install/checkConfiguration.php, can generate videos/configuration.php by interpolating request-controlled values into PHP string literals without adequate escaping. Under the conditions described below, an unauthenticated attacker can inject PHP code into the generated file.
| Field | Value |
|---|---|
| CVE | CVE-2026-61564 |
| Severity | Critical |
| CVSS | 10.0 |
| CVSS vector | Not included in the supplied NVD response; confirm in the complete NVD record |
| Attack vector | Network |
| Authentication required | None |
| Patch available | Yes |
| Affected versions | AVideo versions before 8.1.0 |
| Fixed version | AVideo 8.1.0 and later |
| CISA KEV status | Not listed |
The vulnerability is conditional rather than universally reachable on every running installation. The endpoint is blocked by the presence of an existing videos/configuration.php. Risk is highest during fresh deployments, incomplete installations, or situations where the file has been deleted or moved. The write path may also be influenced through systemRootPath, making deployment hardening and filesystem review important.
Analyst’s Take: Patch first, then determine whether the installer endpoint was reachable while
videos/configuration.phpwas absent. The lack of a public PoC or CISA KEV listing lowers the available evidence of active exploitation, not the consequence of successful code execution.
For broader response planning, review this mobile incident response checklist and consider whether third-party dependencies require additional review using these third-party risk management best practices.
Root Cause
The root cause is unsafe generation of a PHP configuration file from HTTP request parameters. In vulnerable versions, values including webSiteRootURL are inserted into single-quoted PHP string literals without proper escaping. An attacker can terminate a string and append PHP syntax to the generated file. When the file is later included by the application, the injected code executes with the privileges of the web-server process.
The endpoint also requires a systemRootPath value containing index.php. It attempts to connect to a database using databaseHost, databaseUser, and databasePass, but the attacker can point those parameters to an attacker-controlled database server. Valid credentials for the target AVideo database are therefore not required for the described attack path.
The output location is another concern. It is derived from systemRootPath without an enforced base-directory restriction. Depending on deployment permissions and path handling, an attacker may be able to influence where the generated PHP file is written. Successful exploitation could enable arbitrary PHP execution, command execution as the web-server user, file access, persistence, and modification of database connection settings.
Who’s Exposed
The affected software is AVideo before version 8.1.0. The supplied NVD material identifies the affected product as AVideo and references the WWBN/AVideo-Encoder repository, but the compact record does not provide the complete CPE mapping. Administrators should inventory both the main AVideo platform and deployments that use the referenced encoder repository or related installer components.
An installation is particularly exposed when videos/configuration.php is absent. Relevant conditions include:
- A fresh deployment that has not completed installation
- An installation where the configuration file was deleted
- A deployment where the file was moved
- A filesystem or container layout that prevents the application from finding the expected file
- A web server that exposes
install/checkConfiguration.phpto untrusted networks
The available research does not establish a more granular affected-version range than “prior to 8.1.0.” Do not assume that a particular 7.x or earlier point release is safe unless it is demonstrably at or above the fixed release. The fixed version identified by the supplied NVD references is AVideo v8.1.0.
Severity Breakdown
The reported CVSS score is 10.0, indicating critical severity. The supplied NVD response did not include the CVSS vector string, so the complete NVD record should be checked before publishing or reproducing the score in tooling. The available assessment identifies the attack as network-reachable and unauthenticated, with remote code execution as the principal impact.
| CVSS component | Available assessment |
|---|---|
| Attack vector | Network |
| Privileges required | None |
| User interaction | Not supplied in the compact record |
| Scope | Not supplied in the compact record |
| Confidentiality impact | High potential impact |
| Integrity impact | High potential impact |
| Availability impact | High potential impact |
| CVSS score | 10.0 |
| Vector string | Unknown from supplied material |
The practical impact is severe even though exploitation depends on the configuration file being absent. Code executing as the web-server user may read or overwrite accessible application files, alter configuration, establish persistence, access connected data, and launch additional commands. The attacker may also be able to alter database connection settings or use outbound connections from the compromised host.
Treat the conditional installation state as an exposure amplifier, not as a reason to downgrade the issue. Internet-facing staging hosts, newly deployed systems, recovery environments, and misconfigured containers can remain reachable for extended periods while lacking the file that blocks the vulnerable endpoint.
Exploitation Status
CVE-2026-61564 is not listed in the CISA Known Exploited Vulnerabilities catalog based on the supplied lookup. There is no CISA due date or required action associated with the CVE. This means there is currently no CISA confirmation of exploitation in the wild; it does not prove that exploitation has never occurred.
No verified public proof-of-concept repository was identified in the supplied NVD references or research results. The available material also does not confirm exploitation in the wild. State this distinction clearly in incident triage: public PoC: not verified; active exploitation: not confirmed; CISA KEV: not listed.
The absence of a public exploit should not delay remediation. The attack involves a straightforward class of unsafe PHP code generation, and the vulnerable endpoint is reachable over the network when an installation is incomplete or its configuration file is missing. Treat exposed pre-8.1.0 systems as high priority, especially where the installer path is internet-accessible.
Sources
The primary references supplied for this assessment are:
-
NVD record for CVE-2026-61564
Use the complete record to confirm the final CVSS vector, CPE mapping, and full vulnerability description. -
AVideo-Encoder security fix commit
Vendor-repository commit referenced by NVD as remediation evidence. -
AVideo v8.1.0 release
Release identified as containing the fix. -
GitHub Security Advisory GHSA-xrj3-cqm8-r992
Advisory reference associated with the vulnerability.
Based on the available evidence, CVE-2026-61564 should be handled as a critical pre-8.1.0 AVideo exposure with potentially severe consequences on systems where videos/configuration.php is absent. Prioritize upgrading and investigating internet-facing installations, beginning with systems where the installer endpoint was accessible and the configuration file was missing. The supplied research found no confirmed public PoC or in-the-wild exploitation, and the CVE is not currently in CISA KEV; those status indicators do not remove the need for immediate action.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Start by searching web-server access logs for requests to the vulnerable endpoint. A request alone does not prove exploitation, but it identifies systems that may have been probed. Pay particular attention to requests containing systemRootPath, webSiteRootURL, database parameters, encoded quotes, PHP syntax, or unusual path values.
Technical Notes
A generic access-log search can be adapted for Apache, Nginx, load balancers, or centralized logging:
zgrep -hEi \
'install/checkConfiguration\\.php|systemRootPath|webSiteRootURL|databaseHost|databaseUser|databasePass' \
/var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null
For an Elastic-style query, search both the endpoint and indicators of parameter manipulation:
http.request.uri.path : "/install/checkConfiguration.php" and
(
url.query : "*systemRootPath*" or
url.query : "*webSiteRootURL*" or
url.query : "*databaseHost*" or
url.query : "*%27*" or
url.query : "*<?php*" or
url.query : "*base64_decode*"
)
Review the HTTP status, response size, source address, user agent, and subsequent requests from the same client. A successful exploit may be followed by access to a newly created PHP file, requests to unusual paths, outbound connections from the web server, or process execution by the web-server account. Do not rely on a single signature: URL encoding, alternate parameter ordering, POST bodies, and intermediary normalization can obscure the original payload.
Inspect the filesystem and configuration content directly. Compare videos/configuration.php with a known-good file, check its creation and modification timestamps, and search for unexpected PHP constructs or external hosts:
stat videos/configuration.php
grep -nE 'shell_exec|system\\(|passthru|exec\\(|assert\\(|eval\\(|base64_decode|https?://|[0-9]+\\.[0-9]+\\.[0-9]+' \\
videos/configuration.php
find . -type f -name '*.php' -mtime -30 -printf '%TY-%Tm-%Td %TH:%TM %p\\n'
These commands are triage aids rather than definitive detection rules. Preserve the host and relevant logs before making changes if compromise is suspected.
Remediation Steps
Upgrade every affected AVideo installation to 8.1.0 or later. Use the vendor’s documented deployment process rather than copying an isolated file, and verify that the running code, not only the source checkout, matches the fixed release. The supplied research identifies the v8.1.0 release and a vendor-repository commit as the available fix references.
Technical Notes
For a deployment using Git and the vendor repository, an administrator should first review local changes and then move to the fixed tag according to the organization’s change process:
git fetch --tags origin
git checkout v8.1.0
git rev-parse --short HEAD
If the application is deployed from an archive or package, obtain the official v8.1.0 or later release and verify the deployed version through the application’s supported version mechanism. Do not infer that a database migration or restart alone applies the fix.
Until the upgrade is complete, restrict or disable access to the installer endpoint where operationally possible. A web-server rule can provide temporary containment, but the exact location and syntax depend on the deployment. For Nginx, an interim location block may look like:
location = /install/checkConfiguration.php {
deny all;
return 403;
}
Test the rule against the actual URL path and any reverse-proxy prefix before relying on it. This workaround reduces exposure but is not a substitute for upgrading. Also ensure that the web server cannot write arbitrary PHP files into web-accessible directories, and prevent outbound connections from the web process to unapproved destinations where practical.
After patching, inspect videos/configuration.php and related application files for unexpected code or database settings. If logs show suspicious requests, assume possible compromise until investigated. Rotate database credentials, application secrets, and other credentials accessible to the web-server account. Review database audit logs, shell history, scheduled tasks, web-root changes, and outbound network connections. Rebuild from a known-good image if integrity cannot be established.