Zero Radar
← feed
CriticalVulnerabilityCVE-2026-61567updated 28 Oct 2026, 22:18 UTC

AVideo video platform lets outsiders run commands on the server

Attackers can trick the live-streaming feature into running their own commands on the web server, with no login needed. That can expose passwords and let them take over the site.

Fixed in AVideo 8.1.0Official source
SeverityCriticalCVSS 10 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesAVideo 8.1.0 · since 28 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1AttackerHosts a malicious video-list response
  2. 2Unauthenticated requestCalls the live-streaming endpoint
  3. 3Trusted fake sessionServer accepts attacker JSON as login
  4. 4Shell injectionUnescaped video path reaches ffprobe/ffmpeg
  5. 5Data exposedCredentials and files accessible
  6. ResultAttacker runs commands on the server

What happened

In AVideo before 8.1.0, the unauthenticated endpoint view/videosListToLive.php trusts attacker-controlled JSON from a remote host, bypasses the streamer allowlist, and passes unescaped video paths into shell commands (ffprobe/ffmpeg via exec), enabling OS command injection.

Why it is dangerous: Successful exploitation runs arbitrary commands as the web-server user, allowing theft of database and streamer credentials, file modification, persistence, and denial of the encoder service.

Are you affected?

You are affected if you run AVideo earlier than 8.1.0 with the live-streaming endpoint reachable by an encoder.

AVideo versions prior to 8.1.0

What to do

  1. Update AVideo to version 8.1.0 or later
  2. If you cannot update now, restrict access to view/videosListToLive.php at the web server or firewall
  3. Review the server for unexpected files, cron jobs, or new accounts, and rotate database and streamer credentials

Timeline

  1. 28 Oct 2026, 22:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 22:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 22:18 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-61567
CVSS
10 / 10
Disclosed
28 Oct 2026, 22:17 UTC
On Zero Radar
28 Oct 2026, 22:18 UTC (2 min after disclosure)
Last change
28 Oct 2026, 22:18 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

AVideo video platform lets outsiders run commands on the server · Zero Radar