External risk intelligence

AVideo Live Stream Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-61567

AVideo is designed as a video-sharing platform. The vulnerable endpoint, view/videosListToLive.php, is part of the application's core live-streaming functionality. As a web-facing service intended to handle video streams and user-facing interaction, such components are commonly exposed to the internet to facilitate their primary purpose as public or semi-public streaming services.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in the AVideo video-sharing platform that could allow an unauthenticated attacker to execute arbitrary operating-system commands. The flaw resides in how the platform handles live-streaming requests, potentially enabling an attacker to gain unauthorized access, steal credentials, modify files, and disrupt services. The issue is resolved in version 8.1.0.

Remote attackers can run commands on your systems.
This impacts core video streaming and could lead to credential theft.
Confirm if your AVideo instances are exposed and require an update.

Attack Path

How an attacker could exploit the issue

An attacker could compromise this video-sharing platform by hosting an HTTP service that the platform's encoder can reach. This service would trick the platform into granting the attacker administrative access without needing valid credentials. The attacker would then provide a specially crafted list of videos, leading the platform to execute arbitrary commands on the server with the web-server's permissions.

Attacker hosts an external HTTP service.
Vulnerable endpoint processes untrusted video list.
Arbitrary command execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands as the web server user. This occurs when an attacker can host an HTTP service reachable by the encoder, tricking the system into trusting a malicious session and processing a crafted video list. The system then interpolates video paths without proper escaping into `ffprobe` and `ffmpeg` commands, leading to command injection.

Web server files and credentials at risk.
Arbitrary commands executed via crafted video paths.
System compromise and data disclosure possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in AVideo's live-streaming endpoint requires immediate attention from the platform or application owners responsible for the AVideo encoder instances. The first practical steps involve identifying all deployed AVideo instances, confirming their exposure and criticality, and then coordinating remediation with the platform team or vendor.

Platform or application owners should manage the issue.
Verify public exposure and business criticality.
Plan remediation based on risk and impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the AVideo platform?

AVideo is an open-source video-sharing and live-streaming software. It acts as a platform for hosting, managing, and broadcasting media, similar to private or public video distribution services. The system relies on encoders to process video files and streams, which is a core component where this vulnerability resides.

How does CVE-2026-61567 allow command execution?

This vulnerability is a form of OS Command Injection, classified as CWE-78. The software improperly handles input by failing to sanitize video file paths before passing them to system commands like ffprobe and ffmpeg. Because the input is not escaped, an attacker can insert shell characters to run arbitrary commands on the server under the web-server user's identity.

Do I need to be authenticated to trigger this flaw?

No, authentication is not required. An unauthenticated attacker can exploit this by hosting a malicious HTTP service that the AVideo encoder can access. By providing a crafted video list to the vulnerable endpoint, the attacker can bypass login checks and trick the application into executing malicious commands.

Is my AVideo instance likely to be reachable?

According to Halo Surface Signal, AVideo is designed for public or semi-public streaming, meaning it is often intentionally internet-facing. Because this endpoint is central to live-streaming functionality, any instance exposed to the internet is a primary target for remote attackers seeking to exploit this command injection path.

When should I update my AVideo deployment?

You should prioritize updating immediately to version 8.1.0. Start by auditing your environment to locate all deployed AVideo encoder instances. Once identified, evaluate their exposure and business impact to coordinate a rapid patch deployment with your platform team to mitigate the risk of unauthorized server access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.