CVE-2026-61564: Critical RCE in AVideo Installer

AVideo, a video-sharing platform, has a critical vulnerability identified as CVE-2026-61564 affecting all versions prior to 8.1.0. The issue lies in the unauthenticated install/checkConfiguration.php endpoint, which builds videos/configuration.php by interpolating request parameters (including webSiteRootURL) into PHP string literals without escaping.

An attacker can terminate the literal and inject PHP code executed as the web-server user once the generated file is requested. This requires videos/configuration.php to be absent, as on every fresh deployment; an existing file blocks the endpoint. The declared CVSS score is 10.0, critical. A secondary SQL-injection sink also exists via streamer and configuration INSERT statements. No confirmed public exploit in the data, but 6 social posts in the last 24 hours cite high scores: an unverified signal, not proof of active exploitation.

For administrators running AVideo, the priority is updating to version 8.1.0. If immediate updating is not possible, verify that videos/configuration.php already exists, since this blocks the vulnerable endpoint; alternatively, restrict network access to the installer to trusted sources. It is also advisable to check web-server process permissions and review recently-written PHP files, given the arbitrary write capability described by NVD.