WWBN AVideo-Encoder: Unauthenticated PHP code injection in installer
Summary
The unauthenticated installer endpoint install/checkConfiguration.php of AVideo-Encoder writes videos/configuration.php from request parameters without escaping them. An attacker can inject PHP that runs as the web-server user when the generated file is loaded, which allows command execution, file access and persistent code. The attack requires that videos/configuration.php does not exist, as on fresh deployments, and that the attacker's own database server is reachable from the target. The same endpoint also contains a secondary SQL injection.
Affected
- WWBN AVideo-Encoder before 8.1.0 (CNA record: affected < 8.1.0)
- Sources differ on the exact range; some list up to 8.0.x. Verify against the vendor advisory.
Fixed in
- Version 8.1.0 (named in the CVE description and the vendor release)
- The cached GHSA page lists no patched version. Verify on the live advisory.
Workaround
Unknown.
Exploitation
- No source reports active exploitation.
- CISA KEV status: unverified (one aggregator lists 'No').
- Sources report no public exploit, but the GHSA advisory includes reproduction details.
Our recommendation
- Check every AVideo-Encoder instance for the existence of videos/configuration.php and its contents.
- Update to version 8.1.0 or later.
- Restrict access to install/ at the web server or reverse proxy, or remove the installer after setup.
- Check for unexpected PHP files and unknown database settings on instances that were reachable while unconfigured.
- Check whether the main AVideo product is also in use and verify its version separately (CVE-2026-33038).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-xrj3-cqm8-r992 github.com
- AVideo-Encoder release v8.1.0 github.com
- AVideo-Encoder fix commit 0faadde github.com
- VulDB entry 428250 vuldb.com
- VulDB CVE-2026-61564 vuldb.com
- OffSeq threat entry CVE-2026-61564 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:53.
Original description (NVD)
AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php and a connection using `databaseHost`, `databaseUser`, and `databasePass` must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from `systemRootPath` without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.