CVE-2026-61571

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. view/run.php has a commented-out guard and invokes Encoder::run(). view/queue.json.php calls Encoder::getAll(true), reveals streamer URLs through getSiteURL(), and triggers processing with execRun(). view/status.php returns Access-Control-Allow-Origin with a wildcard, reads the queue, triggers processing, and exposes host memory statistics through ServerMonitor::getMemory() when serverStatus is set. view/listFiles.json.php checks only Login::canBulkEncode(), which admits anonymous callers whenever disableBulkEncode is empty, the default. Its path parameter is resolved with realpath() and listed with scandir() without a base-directory restriction. An unauthenticated attacker can drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics and enumerate media file names and paths in any directory readable by the web-server user. Enumeration is limited to configured media extensions and does not itself disclose arbitrary file contents. This issue is fixed in version 8.1.0.