# CVE-2026-61564: AVideo unauthenticated code injection in installer

Source: https://junglewise.ai/threats/cve-2026-61564-avideo-is-a-video-sharing-platform-prior-to-8-1-0-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-61564 · Severity: critical · CVSS 10 · Published 2026-10-28

AVideo is a video-sharing platform that allows users to upload and stream videos. The installer endpoint was vulnerable to unauthenticated remote code execution: an attacker could inject malicious PHP code by manipulating installer parameters, allowing them to execute arbitrary commands and fully compromise the server. This only affected fresh installations or cases where the configuration file was missing.

Technologies: [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-61564 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61564 being exploited in the wild.

**How severe is CVE-2026-61564?** Critical severity, with a CVSS score of 10, published 28 October 2026.

**Which products and versions are affected?** WWBN AVideo before 8.1.0.

**Is there a fix for CVE-2026-61564?** Yes: fixed in 8.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61564 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-61564?** Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.1.0

## Technical details

The `install/checkConfiguration.php` endpoint interpolates unsanitized request parameters (including `webSiteRootURL`) into single-quoted PHP string literals without escaping when generating `videos/configuration.php`, enabling PHP code injection. The vulnerability also contains secondary SQL-injection sinks in streamer and configuration INSERT statements. Exploitation requires the configuration file to be absent and the ability to point database parameters to an attacker-controlled server; no target credentials are needed, and the attacker gains arbitrary file read/write and command execution as the web-server user.

## Affected products

- WWBN AVideo before 8.1.0

## Timeline

- 2026-10-28: disclosed
- 2026-09-23: patched

## References

- [https://github.com/WWBN/AVideo-Encoder/commit/0faaddebd11c087885d25a7e0513745465cad411](https://github.com/WWBN/AVideo-Encoder/commit/0faaddebd11c087885d25a7e0513745465cad411)
- [https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0](https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)