CVE-2026-61564

AVideo-Encoder: unauthenticated installer PHP code injection

No known exploitation. EPSS puts it in the 46th percentile. No fix published yet.

CVSS 3.110.0Critical EPSS percentile46th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-10-28Updated 2026-11-03Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

WWBN AVideo-EncoderAffected: < 8.1.0Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your AVideo-Encoder installation still has a file called videos/configuration.php present and whether the installer endpoint is still reachable from the internet.
If the configuration file is missing (fresh install, or it was deleted/moved), restrict or remove public access to the install/checkConfiguration.php endpoint immediately.
Confirm with your developer or hosting provider whether a fixed version is available, since no official patch has been confirmed yet.
Once a vendor update is released, apply it right away and re-verify the installer endpoint is blocked or no longer vulnerable.
Review server and database logs for unexpected installer requests or new PHP files you did not create.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php and a connection using `databaseHost`, `databaseUser`, and `databasePass` must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from `systemRootPath` without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.

In plain language

Written by AI from the record

A serious flaw in the AVideo-Encoder installer could let an outside attacker take over the server without logging in, but there's no sign anyone is actively exploiting it yet — if you run AVideo-Encoder, you should check your setup soon and act on a fix once one is confirmed available.

Unauthenticated PHP code injection in AVideo's installer endpoint install/checkConfiguration.php (CWE-94), which interpolates attacker-controlled request parameters unescaped into generated PHP configuration files, allowing arbitrary code execution as the web-server user when videos/configuration.php is absent.

If you're affected

Full server takeover
Persistent malicious code on server
Customer/database data exposure
Operational disruption
Site defacement or hijack

What is it

AVideo-Encoder has a setup tool for first-time installation. The problem is that this setup tool doesn't properly check what visitors type in, so a stranger with no account can sneak in computer commands disguised as normal setup information. It's like leaving the front-door lock installation kit sitting outside, unsupervised, where anyone passing by could tamper with it and get a copy of your house key.

Who is affected

This matters to you if you run AVideo-Encoder, especially on a server or installation that is reachable from the internet and where the setup/installer process has not been fully completed or locked down. It also matters if you ever removed or reset the system's configuration file, since the installer endpoint becomes exploitable again in that state. This is only a risk if the installer is reachable from the internet and the configuration file is missing — an attacker needs no account or password.

How urgent is it

Nobody has reported active attacks or public exploit code for this yet, so this is not an emergency fire-drill, but the vulnerability needs no login and is rated as critical in severity, so it deserves prompt attention rather than being shelved. Act within the next days to confirm exposure and lock down the installer, since sustained press coverage suggests attackers are paying attention even though exploitation hasn't been confirmed. Treat this as 'fix soon,' not 'fix today.'

What to do — in detail

Audit all AVideo-Encoder deployments to determine whether install/checkConfiguration.php is internet-reachable and whether videos/configuration.php currently exists (its absence is the precondition for exploitation).
As an immediate workaround, block external access to the installer path at the web server or firewall level, or ensure videos/configuration.php is present and non-empty to disable the vulnerable code path.
No confirmed official patch/version has been verified through patch-tracking at this time; monitor the vendor's release notes closely — publicly circulated descriptions reference a fix in version 8.1.0, but this is unconfirmed by patch-tracking sources and should be validated before relying on it.
Also note the secondary SQL-injection sink in the same endpoint's INSERT statements for streamer/configuration data — any mitigation should cover both the PHP injection and SQL injection vectors.
Monitor web server access logs for requests to install/checkConfiguration.php, unexpected outbound database connections, and newly created or modified PHP files under the web root; monitor for unauthorized changes to database connection settings stored by the application.
Not listed in CISA KEV and no public exploit code is currently known; EPSS places predicted exploitation likelihood in the mid-range with a flat trend, consistent with elevated-but-not-urgent risk.

Technical context

CVSS 3.1 score 10.0 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-exploitable, no privileges or user interaction required, scope change, full compromise of confidentiality/integrity/availability. Weakness is CWE-94 (Code Injection): unescaped interpolation of request parameters (webSiteRootURL, systemRootPath, databaseHost/User/Pass) into single-quoted PHP string literals during generation of videos/configuration.php, allowing literal termination and injection of arbitrary PHP executed as the web-server user. Exploitation precondition: target configuration file must be absent (fresh install or post-removal state); attacker supplies their own database server for the required connection test. A secondary SQL-injection sink exists via unsanitized INSERT statements for streamer/configuration data. Not in CISA KEV; no public exploit code identified; EPSS predicts a 0.5% likelihood of exploitation (46th percentile) with a flat trend, indicating low near-term predicted exploitation despite sustained press attention. No fix/patch has been confirmed through patch-tracking sources as of this writing.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS46th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 46th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained.

Lifecycle

6 events over 6 days, from the signal feeds we watch.

2026-11-03Record updated
2026-10-29Record updated
2026-10-28Publishedweakness classified, att&ck mapped, record updated

Affected products

WWBNcommercial
- AVideo-EncoderWeb & CMS Plugins

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-94No name in the record

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

ExecutionT1059Command and Scripting Interpreterhigh confidence
Initial AccessT1190Exploit Public-Facing Applicationhigh confidence

Sources

References in the record

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for AVideo-Encoder, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account