AVideo-Encoder CVE-2026-61575

Exploitation requires three concrete conditions. First, the attacker must submit a queue entry, which needs the Login::canUpload() capability; because fileURI is in no objects/security.php filter list and the capability can be self-granted by pointing the encoder's login at an attacker-controlled site (siteURL) that returns canUpload=true, no legitimate encoder credentials are needed. Second, the payload is placed in the filename component of fileURI (parsed by pathinfo, stored via setTitle into encoder_queue.title) and survives unneutralized. Third - the key limiting factor - a privileged viewer the attacker does not control must open the queue dashboard: Encoder::getAll restricts non-administrators to their own streamer's rows, so the victim must be an administrator (who sees all streamers' rows) or an operator on the attacker's own streamer. The reliably reachable sink is the jQuery Bootgrid #grid title formatter, which is triggered from encoder code alone; a second sink in the progress panel's .html() call additionally depends on a helper script loaded from the streamer platform, so it is less dependable. Exploitation is bounded by this need for a privileged viewer rather than any special server configuration.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS 3.1 base score of 4.7 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects real friction: although PR:N is justified because the submitting capability (Login::canUpload()) can be self-granted against an attacker-controlled login site with no legitimate credentials, exploitation still requires a privileged viewer the attacker does not control (AC:H, UI:R) - an administrator who sees every streamer's rows, or an operator on the attacker's own streamer - to open the queue dashboard before the stored payload fires. The scope change (S:C) and C:L/I:L capture script execution in that victim's authenticated session. No CISA KEV entry and no EPSS score were provided, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-not-urgent stored XSS. A detailed public PoC is published in the GHSA advisory (a Python login stub plus curl commands), which raises practical exploitability above a theoretical finding. Net: prioritize patching on a normal cycle, weighted up because the victim is typically an administrator whose compromise is high-value, and weighted down by the dependence on an uncontrolled privileged viewer.

An attacker points the encoder at their own login site that returns canUpload=true, self-granting the capability to submit a queue entry without real encoder credentials, then submits a fileURI whose filename component is an <img src=x onerror=...> payload that is stored verbatim in encoder_queue.title. When an administrator later opens the queue dashboard, the jQuery Bootgrid title formatter writes the stored title into the table cell as raw HTML, the image fails to load, and its onerror handler executes script in the administrator's authenticated session. A working public PoC demonstrating exactly this (self-grant, plant, and confirm via queue.json) is included in the GHSA advisory, though it is not packaged as a verified turnkey exploit.