WWBN AVideo-Encoder: Unauthenticated command injection via streamer login trust
Summary
The live-streaming endpoint view/videosListToLive.php in AVideo-Encoder trusts a streamer URL and a remote video list supplied by the caller, and does not check the streamer against an allowlist. Video paths from that remote list are passed unescaped into ffprobe and ffmpeg shell commands. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can run arbitrary operating-system commands as the web-server user, read database and stored streamer credentials, and modify files.
Affected
- WWBN AVideo-Encoder versions before 8.1.0
- The VulDB record describes up to 8.0.x; the exact earliest affected version is unknown.
Fixed in
- Fixed in version 8.1.0 (commit 99b8ad9).
Workaround
- No vendor-documented workaround.
- Restrict network access to the encoder endpoints to known streamer IP addresses.
- Restrict outbound connections from the encoder host.
Exploitation
- Not known to be exploited in the wild; CISA KEV status: not listed.
- The GHSA advisory describes a reproduction with a file-write proof and an out-of-band callback; no standalone public exploit was verified.
Our recommendation
- Inventory all AVideo-Encoder instances now and identify any reachable from the internet.
- Upgrade to version 8.1.0 and apply the related encoder fixes from the same batch (CVE-2026-61571, CVE-2026-61564).
- Restrict internet exposure and outbound connections of the encoder host until patched.
- If an instance ran a vulnerable version while exposed, review logs and rotate stored credentials.
- Recheck threat intelligence status in the coming days.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 99b8ad9 github.com
- Release v8.1.0 github.com
- GHSA-rf63-6vwm-wv8p advisory github.com
- VulDB CVE-2026-61567 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:53.
Original description (NVD)
AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant `isLogged` and `canStream` without legitimate credentials. The endpoint requires only nonempty `playlists_id` and `APISecret` values; `APISecret` is forwarded rather than checked against a stored secret. This path never calls `Streamer::isURLAllowed` and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates `videos[].path` without shell argument escaping into `ffprobe` and `ffmpeg` commands passed to `exec`; `isAudio` calls `isVideo` to reach the `ffprobe` command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.