Zero Radar
← feed
CriticalVulnerabilityCVE-2026-61564updated 28 Oct 2026, 22:18 UTC

AVideo video platform: unauthenticated installer allows server takeover

Someone on the internet can send a crafted request to the setup page and run their own code on the web server, if the site's setup file is missing. That gives them control of the server.

Fixed in AVideo 8.1.0Official source
SeverityCriticalCVSS 10 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesAVideo 8.1.0 · since 28 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1AttackerSends crafted request to installer
  2. 2Unauthenticated requestNo login needed on install endpoint
  3. 3Config file writtenParameters injected into PHP file
  4. 4Code executesGenerated file runs attacker PHP
  5. ResultAttacker controls the web server

What happened

The unauthenticated installer endpoint install/checkConfiguration.php writes videos/configuration.php by inserting request parameters into PHP string literals without escaping, enabling PHP code injection, plus a secondary SQL-injection sink in streamer and configuration INSERT statements.

Why it is dangerous: A successful attacker can execute arbitrary commands as the web-server user, read and overwrite its files, plant persistent PHP code, and redirect database settings to their own server. Anyone running a fresh or reinstalled AVideo instance is at risk.

Are you affected?

You are affected if you run AVideo prior to 8.1.0 and videos/configuration.php is absent, as on a fresh deployment or after the file has been removed or moved.

AVideo versions prior to 8.1.0

What to do

  1. Update AVideo to version 8.1.0 or later
  2. Confirm videos/configuration.php exists on every installation so the installer endpoint is blocked
  3. Until updated, block or restrict access to install/checkConfiguration.php
  4. Review the web server for unexpected PHP files or changes after any exposure

Timeline

  1. 28 Oct 2026, 22:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 22:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 22:18 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-61564
CVSS
10 / 10
Disclosed
28 Oct 2026, 22:17 UTC
On Zero Radar
28 Oct 2026, 22:18 UTC (2 min after disclosure)
Last change
28 Oct 2026, 22:18 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

AVideo video platform: unauthenticated installer allows server takeover · Zero Radar