CVE-2026-61564

Summary

The install/checkConfiguration.php endpoint in AVideo before 8.1.0 constructs a PHP configuration file by unsafely interpolating unauthenticated user input into single-quoted PHP strings, allowing an attacker to break out of the string and inject arbitrary PHP code that executes on the server when the generated file is loaded.

Exploitability

Exploitation requires a fresh deployment or manually removed/renamed videos/configuration.php, successful database connectivity (which the attacker can control by pointing to their own server), and supply of a systemRootPath containing index.php; no authentication or prior knowledge of target credentials is needed.

Blast radius

Successful exploitation grants full remote code execution as the web-server user, enabling complete compromise of the host, persistent backdoors via PHP file writes, and manipulation of stored database credentials.

Detection

An attacker must first trigger the install/checkConfiguration.php endpoint with malicious parameters; defenders should monitor for HTTP requests to /install/checkConfiguration.php containing suspicious strings like single quotes, semicolons, or PHP tags (e.g., '?>') in parameters such as webSiteRootURL, systemRootPath, databaseHost, databaseUser, or databasePass, especially when videos/configuration.php does not yet exist.

Prioritized remediation

Upgrade to AVideo version 8.1.0 or later, which fixes the unsafe string interpolation in the installer endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.