AVideo-Encoder EUVD-2026-112507

Exploitation requires the install window: videos/configuration.php must be absent, which is the default state of a fresh AVideo-Encoder deployment and also occurs if the file is later deleted or moved - an existing configuration.php makes the endpoint exit early and blocks the attack entirely. Beyond that, two trivially met gates apply: the supplied systemRootPath must resolve to a directory containing index.php (the application document root satisfies this), and a MySQL connection using databaseHost/databaseUser/databasePass must succeed - but the attacker points these at their own database server, so no target credentials or knowledge of the target database are needed. No authentication, no user interaction, and no token/authorization check exist on the endpoint (the only guard is the config-file existence check). The write path is derived from attacker-controlled systemRootPath with no base-directory constraint. Net limiting factor: realistic exposure is confined to instances currently in, or returned to, the uninitialized install state rather than fully configured running systems.

All severity signals point the same direction: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, base 10.0) describes remote, unauthenticated, no-interaction exploitation, and the vuln.today decision label is act_now. A complete, working proof-of-concept (curl commands plus the resulting injected line) is published in the vendor's GHSA advisory, so this is not theoretical. However, the single factor that moderates real-world exposure is a precondition the CVSS vector does not capture: the endpoint only functions while videos/configuration.php is absent (the fresh-install window, or after the file is removed/moved) - an existing file blocks it entirely, so the exposed population is systems that are mid-install, newly deployed, or that have had the config file deleted, not every running instance. No CISA KEV listing is present in the input and no EPSS probability was supplied, so widespread automated exploitation cannot be confirmed or ruled out from the data; given a niche product plus the install-window gate, targeted rather than mass exploitation is the more likely pattern. Treat as a genuine act_now priority for any instance currently in or re-entering the install state. Note one data hygiene issue: the Description opens by calling this 'AVideo, a video-sharing Platform,' but the CPE (wwbn:avideo-encoder), EUVD affected list (AVideo-Encoder < 8.1.0), and the GHSA advisory all scope the flaw to the AVideo-Encoder component - verify you are assessing the encoder, not the main AVideo platform.

While a target AVideo-Encoder is in its install window (configuration.php not yet present), an unauthenticated attacker sends a single POST to install/checkConfiguration.php with databaseHost pointing at a MySQL server they control and a webSiteRootURL value that closes the single-quoted PHP literal and appends system($_GET['c']). The installer writes this attacker PHP into a directly requestable videos/configuration.php, and a follow-up GET to that file with a command in 'c' runs OS commands as the web-server user. A full working PoC for exactly this flow is published in the GHSA advisory.