AVideo-Encoder EUVD-2026-112514

No special conditions in the default configuration - remote unauthenticated exploitation works against default installations of AVideo-Encoder (WWBN) prior to 8.1.0 because there is no global authentication layer, the shipped .htaccess denies only .git/*.log/avideo.log, and Login::canBulkEncode() returns true whenever the disableBulkEncode setting is empty (the default). The specific prerequisite for the file-enumeration vector is that the attacker-supplied path resolves via realpath() to a directory readable by the web-server user; status.php memory leakage requires the serverStatus request path. Limiting factors that reduce realistic impact: file enumeration is restricted to configured media extensions and returns only file names and paths, not file contents (no arbitrary file disclosure); setting disableBulkEncode would restrict listFiles access; and overall impact is bounded to control-plane actions and information exposure rather than code execution. Network reachability of the encoder document root is required.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3 High) is internally consistent with the described flaw: a missing global authentication layer (CWE-306/CWE-862) that leaves control and status endpoints reachable by anonymous network callers in the default configuration (disableBulkEncode empty, .htaccess blocking only .git/*.log). PR:N is justified because the shipped defaults admit anonymous callers, and AC:L is justified because exploitation is simple HTTP requests with no special timing or grooming described. The impacts are correctly scoped as Low across C/I/A: confidentiality is limited to queue data, streamer site URLs, host memory statistics and media file names/paths (the advisory explicitly notes enumeration does not disclose arbitrary file contents), and integrity/availability are limited to driving the privileged queue processor rather than code execution. The vuln.today priority label is 'this_week' (not act_now/emergency), which aligns with a serious-but-not-catastrophic information-exposure and control-plane flaw. No EPSS score and no CISA KEV status were provided in the input, so real-world exploitation probability cannot be quantified from this data; absence of KEV means there is no evidence of active exploitation. A public PoC reference exists in the GitHub Security Advisory (working curl commands), raising practical exploitability above the EPSS-unknown baseline. Net: this is a genuine priority for exposed AVideo-Encoder instances because it is unauthenticated, network-reachable, default-config-exploitable, and has published PoC steps - but the capped Low impacts keep it below critical-severity remote-code-execution class issues.

An unauthenticated attacker who can reach an internet- or network-exposed AVideo-Encoder sends simple anonymous HTTP requests to view/run.php, view/queue.json.php, view/status.php and view/listFiles.json.php to drive the queue processor, read the job queue and streamer site URLs, leak host memory statistics, and enumerate media file names and paths in any directory the web-server user can read. A public PoC reference with working curl commands exists in the GitHub Security Advisory; it is not separately verified in this input as a packaged working exploit. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction and low attack complexity, so the requests succeed against default installations.