AVideo-Encoder CVE-2026-61569

Exploitation requires that (1) the AVideo-Encoder instance is network-reachable, (2) the operator has NOT populated the streamer allowlist, because Streamer::isURLAllowed returns true by default when the allowlist is empty, (3) the attacker can host an HTTP listener that the encoder can resolve and reach and whose login response sets canUpload or isAdmin true, reaching Streamer::createIfNotExists and thus the Streamer::get sink before the secondary allowlist re-check, and (4) the single quote is delivered as a numeric HTML entity so it survives the $securityRemoveSingleQuotes filter in security.php and is then restored to a literal quote by html_entity_decode in Login.php. Limiting factors: an operator-populated allowlist blocks the attacker siteURL; the encoder must be able to call back to the attacker's host; and impact is bounded to database reads (the mysqli driver forbids stacked statements and the tested DB account lacks global FILE privilege, so no writes or server-side file operations were demonstrated). Fixed in version 8.1.0; the vendor fix (parameterization) is the complete remedy.

CVSS 3.1 base score is 7.5 (HIGH) driven entirely by the confidentiality impact (C:H) of an unauthenticated, network-reachable, low-complexity SQL injection (AV:N/AC:L/PR:N/UI:N). The vuln.today decision label is 'this_week', which signals a prompt but non-emergency patch priority. No CISA KEV listing is present in the input, so there is no confirmed active exploitation; no EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from this data. A detailed public PoC (curl-based UNION and error-based payloads) is published inside the GHSA advisory itself, which materially lowers the attacker skill barrier even though the input does not flag it as a verified weaponized exploit. The signals are therefore consistent rather than conflicting: high technical confidentiality impact and a ready PoC, but no evidence of mass exploitation and a product with a small deployment footprint. The AC:L rating understates real-world friction - successful attack additionally requires that the operator has left the streamer allowlist empty (the default) and that the encoder can resolve and reach an attacker-hosted HTTP listener returning canUpload/isAdmin true - so this is a genuine priority for anyone running AVideo-Encoder, but closer to a targeted/opportunistic read-only data-theft risk than an internet-wide worming threat.

An unauthenticated attacker points an exposed AVideo-Encoder at an attacker-controlled HTTP listener (via the siteURL parameter, which the default-empty allowlist accepts) that returns a login response asserting canUpload/isAdmin true, then sends an entity-encoded single quote in the user parameter to bypass the security.php quote filter after html_entity_decode restores it. A UNION-based payload reads arbitrary encoder database contents one value per request through the streamers_id field of the JSON response, while a malformed payload leaks the rendered query and MariaDB error for easy payload tuning. A fully working PoC with exact curl commands is published in the GHSA advisory.