Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61567— AVideo-Encoder: unauthenticated command execution through streamer login trust

Quick assessment

Affected
WWBN AVideo-Encoder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AVideo 是一个视频分享平台。在 8.1.0 版本之前，直播流端点 会接受攻击者指定的 中的主播名称，调用 中的 方法，并将返回的 JSON 数据直接信任为会话状态。任何能够部署一个编码器可访问的 HTTP 服务的未认证远程攻击者，均可无需合法凭据即可自行授予 和 权限。该端点仅需非空的 和 参数；其中 仅被透传，并未与存储的密钥进行校验。此路径从未调用 方法，因此无论运营方是否配置了主播白名单，攻击均可生效。该端点还会获取第二个由攻击者控制的视频列表响应，并将 字段未经 Shell 参数转义直接拼接到通过 执

CVSS 10.0 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61567

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AVideo-Encoder: unauthenticated command execution through streamer login trust
Source: CVE Program / CVE List V5
Vulnerability Description
AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant `isLogged` and `canStream` without legitimate credentials. The endpoint requires only nonempty `playlists_id` and `APISecret` values; `APISecret` is forwarded rather than checked against a stored secret. This path never calls `Streamer::isURLAllowed` and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates `videos[].path` without shell argument escaping into `ffprobe` and `ffmpeg` commands passed to `exec`; `isAudio` calls `isVideo` to reach the `ffprobe` command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WWBN AVideo-Encoder < 8.1.0 -

II. Public POCs for CVE-2026-61567

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61567

请登录查看更多情报信息。

Other References for CVE-2026-61567 (3)

Same Patch Batch · WWBN · 2026-10-28 · 7 CVEs total

CVE-2026-61564 10.0 CRITICAL AVideo-Encoder: unauthenticated installer PHP code injection
CVE-2026-61572 8.6 HIGH AVideo-Encoder: unauthenticated full-response server-side request forgery
CVE-2026-61569 7.5 HIGH AVideo-Encoder: pre-authentication streamer-login SQL injection
CVE-2026-61571 7.3 HIGH AVideo-Encoder: missing authentication on control and status endpoints
CVE-2026-61573 6.1 MEDIUM AVideo-Encoder: reflected cross-site scripting in the login interface
CVE-2026-61575 4.7 MEDIUM AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles

IV. Related Vulnerabilities

Same product: AVideo-Encoder
Same vendor: WWBN
Same weakness: CWE-78