Quick answers
- Is CVE-2026-61567 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-61567 being exploited in the wild.
- How severe is CVE-2026-61567?
- Critical severity, with a CVSS score of 10, published 28 October 2026.
- Which products and versions are affected?
- WWBN AVideo Encoder prior to 8.1.0.
- Is there a fix for CVE-2026-61567?
- Yes: fixed in 8.1.0. Until then: Restrict network access to the encoder from untrusted sources; disable or restrict the live-streaming endpoint if not in use. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-61567 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-61567?
- Check whether you run WWBN AVideo Encoder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 8.1.0
Restrict network access to the encoder from untrusted sources; disable or restrict the live-streaming endpoint if not in use.
Technical details
The `view/videosListToLive.php` endpoint accepts an attacker-controlled `webSiteRootURL` parameter, trusts the returned JSON session state without verification, and fetches a second attacker-controlled video-list response. Video paths from this response are interpolated directly into `ffprobe` and `ffmpeg` commands without shell argument escaping before being passed to `exec()`. An unauthenticated remote attacker reachable by the encoder can craft paths containing shell delimiters to achieve arbitrary command execution as the web-server user, bypassing the streamer allowlist checks that are not called by this endpoint.
Affected products
- WWBN AVideo Encoder prior to 8.1.0
Timeline
- 2026-10-28: disclosed